From 95e3447b967242f57d59ce4bf89d6d6a43699e9a Mon Sep 17 00:00:00 2001 From: Kris Nuttycombe Date: Tue, 8 Nov 2022 12:51:01 -0700 Subject: [PATCH] Fix potential path or symlink traversal Use `realpath` instead of `abspath` and remove unused `safe_extract` arguments & defaults. Reviewed with @daira @str4d @sellout --- qa/rpc-tests/upgrade_golden.py | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/qa/rpc-tests/upgrade_golden.py b/qa/rpc-tests/upgrade_golden.py index 404cb1e86..34e249ac7 100755 --- a/qa/rpc-tests/upgrade_golden.py +++ b/qa/rpc-tests/upgrade_golden.py @@ -79,26 +79,23 @@ class UpgradeGoldenTest(BitcoinTestFramework): regtest_path = self.options.tmpdir+"/node"+ str(i)+"/regtest" shutil.rmtree(regtest_path) with tarfile.open(upgrade.tgz_path, "r:gz") as tgz: - def is_within_directory(directory, target): - - abs_directory = os.path.abspath(directory) - abs_target = os.path.abspath(target) + def is_within_directory(directory, target): + abs_directory = os.path.realpath(directory, strict=True) + abs_target = os.path.realpath(target, strict=True) prefix = os.path.commonprefix([abs_directory, abs_target]) return prefix == abs_directory - def safe_extract(tar, path=".", members=None, *, numeric_owner=False): - + def safe_extract(tar, path): for member in tar.getmembers(): member_path = os.path.join(path, member.name) if not is_within_directory(path, member_path): - raise Exception("Attempted Path Traversal in Tar File") + raise Exception("Attempted Path or Symlink Traversal in Tar File") - tar.extractall(path, members, numeric_owner=numeric_owner) - + tar.extractall(path) - safe_extract(tgz, path=regtest_path) + safe_extract(tgz, regtest_path) # Upgrade each node to the latest network version. If any fails to # start, this will fail the test.