Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions cli.py
Original file line number Diff line number Diff line change
Expand Up @@ -205,31 +205,30 @@ def main():
@contextlib.contextmanager
def prepare_source_path(path: Path):
if _is_zip(path):
import tempfile, zipfile
with tempfile.TemporaryDirectory() as tmpdir:
import zipfile
with managed_temp_dir(args.temp_dir) as tmpdir:
try:
with zipfile.ZipFile(path) as zf:
# Path traversal validation (same logic MkPFS used)
for member in zf.infolist():
dest = Path(tmpdir) / member.filename
dest = tmpdir / member.filename
try:
dest.resolve().relative_to(Path(tmpdir).resolve())
dest.resolve().relative_to(tmpdir.resolve())
except ValueError:
print(f"[ERROR] ZIP path traversal detected: {member.filename}")
sys.exit(1)
zf.extractall(tmpdir, pwd=args.password.encode() if args.password else None)
yield Path(tmpdir)
zf.extractall(str(tmpdir), pwd=args.password.encode() if args.password else None)
yield tmpdir
except (zipfile.BadZipFile, RuntimeError) as exc:
print(f"[ERROR] ZIP extraction failed: {exc}")
sys.exit(1)
elif _is_rar(path):
import tempfile
from unrar import rarfile
with tempfile.TemporaryDirectory() as tmpdir:
with managed_temp_dir(args.temp_dir) as tmpdir:
try:
with rarfile.RarFile(path, pwd=args.password) as rf:
rf.extractall(tmpdir)
yield Path(tmpdir)
rf.extractall(str(tmpdir))
yield tmpdir
except rarfile.RarWrongPassword:
print("[ERROR] RAR extraction failed: wrong or missing password")
sys.exit(1)
Expand Down