unblob
unblob copied to clipboard
Resolve path traversal and unhandled permission error in tar handler
Fixed path traversal in python's builtin tarfile module and added a privilege check when tarfile attempts to create device files.
This fixes #456 and #459
Brought to you by the excellent upstream connection on Thalys high speed train.
More info about traversal: https://davidhamann.de/2022/09/23/python-tarfile-vulnerability/
Note: modifications to extract and _extract_member are preceded by a MOD: comment. The code was copied in place otherwise, and a the code complexity check had to be disabled.