4 ms·

> In fact, Python libraries were vulnerable until fixed in 2014. This is incorrect. Python's tarfile and zipfile (and shutil) modules have no protection agains

• masklinn 8y ago
  https://docs.python.org/3/library/zipfile.html?highlight=zipfile#zipfile.ZipFile.extract https://docs.python.org/3/library/zipfile.html?highlight=zip... > If a member filename is an absolute path, a drive/UNC sharepoint and leading (back)slashes will be stripped, e.g.: ///foo/bar becomes foo/bar on Unix, and C:\foo\bar becomes foo\bar on Windows. And all ".." components in a member filename will be removed, e.g.: ../../foo../../ba..r becomes foo../ba..r. On Windows illegal characters (:, <, >, |, ", ?, and *) replaced by underscore (_). Sure reads like directory traversal mitigation.
  • bjpbakker 8y ago
    It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal. While by itself this might be a deliberate design choice, it vows for an easy mistake. I'm a fan of telling that a function is unsafe (by design) by its name. So `unsafeExtractall` or something like it. That should give a clear warning to investigate unless you know what you're doing.
    • ishi 8y ago
      `extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths. See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py https://github.com/python/cpython/blob/3.6/Lib/zipfile.py
      • bjpbakker 8y ago
        Good catch. Seems like the docs warn too much on this then, but good to see that it's not a problem in Python.
        • deleted 8y ago
          [deleted]
    • irishsultan 8y ago
      The warning says that it attempts to mitigate it (with a referral to the documentation of the extract function). It's of course a bit strange that in one case it's a note that explains how the mitigation works, and in the other case it's a warning to not blindly trust foreign zips, but it seems clear to me that either both are affected, or neither of them is.
      • wstuartcl 8y ago
        Documentation, the other "hard" task in CS.
    • masklinn 8y ago
      > It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal. You're misreading the warning. It's saying that the module attempts to mitigate the issue (referring back to ZipFile.extract) but pointing out that this may not be entirely reliable, and thus that as the library user you really should inspect/validate archive paths before doing an on-disk extraction.
  • jwilk 8y ago
    I stand corrected. I was mislead by the scary warning, which is still there. The tarfile module is still vulnerable: https://bugs.python.org/issue17102 https://bugs.python.org/issue17102