zecfoundation
/
zcashd
mirror of https://github.com/ZcashFoundation/zcashd.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix potential path or symlink traversal 

Use `realpath` instead of `abspath` and remove unused `safe_extract` arguments & defaults.

Reviewed with @daira @str4d @sellout
This commit is contained in:
Kris Nuttycombe 2022-11-08 12:51:01 -07:00 committed by Kris Nuttycombe
parent 543df3797a
commit 95e3447b96
1 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
qa/rpc-tests/upgrade_golden.py
View File

@ -79,26 +79,23 @@ class UpgradeGoldenTest(BitcoinTestFramework):
regtest_path = self.options.tmpdir+"/node"+ str(i)+"/regtest"
shutil.rmtree(regtest_path)
with tarfile.open(upgrade.tgz_path, "r:gz") as tgz:
def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
def is_within_directory(directory, target):
abs_directory = os.path.realpath(directory, strict=True)
abs_target = os.path.realpath(target, strict=True)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
def safe_extract(tar, path):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
raise Exception("Attempted Path or Symlink Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
tar.extractall(path)
safe_extract(tgz, path=regtest_path)
safe_extract(tgz, regtest_path)
# Upgrade each node to the latest network version. If any fails to
# start, this will fail the test.