Mirrors/overte-JulianGro
3
0
Fork 0
mirror of https://github.com/JulianGro/overte.git synced 2025-04-07 09:42:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #240 from TrellixVulnTeam/master

Browse source 
CVE-2007-4559 Patch
This commit is contained in:
Dale Glass 2022-11-06 20:31:19 +01:00 committed by GitHub
commit 299fc2365b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
hifi_utils.py
View file

@ -131,7 +131,26 @@ def downloadAndExtract(url, destPath, hash=None, hasher=hashlib.sha512(), isZip=
else:
# Extract the archive
with tarfile.open(tempFileName, 'r:*') as tgz:
tgz.extractall(destPath)
def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tgz, destPath)
os.remove(tempFileName)
def readEnviromentVariableFromFile(buildRootDir, var):