diff --git a/utils/scanpypi b/utils/scanpypi index a75d696222..bdce6924b6 100755 --- a/utils/scanpypi +++ b/utils/scanpypi @@ -225,6 +225,22 @@ class BuildrootPackage(): self.filename = self.used_url['filename'] self.url = self.used_url['url'] + def check_archive(self, members): + """ + Check archive content before extracting + + Keyword arguments: + members -- list of archive members + """ + # Protect against https://github.com/snyk/zip-slip-vulnerability + # Older python versions do not validate that the extracted files are + # inside the target directory. Detect and error out on evil paths + evil = [e for e in members if os.path.relpath(e).startswith(('/', '..'))] + if evil: + print('ERROR: Refusing to extract {} with suspicious members {}'.format( + self.filename, evil)) + sys.exit(1) + def extract_package(self, tmp_path): """ Extract the package contents into a directrory @@ -249,6 +265,7 @@ class BuildrootPackage(): print('Removing {pkg}...'.format(pkg=tmp_pkg)) shutil.rmtree(tmp_pkg) os.makedirs(tmp_pkg) + self.check_archive(as_zipfile.namelist()) as_zipfile.extractall(tmp_pkg) pkg_filename = self.filename.split(".zip")[0] else: @@ -264,6 +281,7 @@ class BuildrootPackage(): print('Removing {pkg}...'.format(pkg=tmp_pkg)) shutil.rmtree(tmp_pkg) os.makedirs(tmp_pkg) + self.check_archive(as_tarfile.getnames()) as_tarfile.extractall(tmp_pkg) pkg_filename = self.filename.split(".tar")[0]