From 267b9373d8a0d1dd998cb127de88a3272dbfc92f Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Sun, 2 Oct 2022 20:53:17 +0000 Subject: [PATCH 1/2] Adding tarfile member sanitization to extractall() --- .../GA/hnsw/benchmarks/benchmark_script.py | 21 ++++++++++++++++++- .../hnsw/benchmarks/benchmark_script.py | 21 ++++++++++++++++++- .../hnsw/benchmarks/benchmark_script.py | 21 ++++++++++++++++++- 3 files changed, 60 insertions(+), 3 deletions(-) diff --git a/algorithms/GA/hnsw/benchmarks/benchmark_script.py b/algorithms/GA/hnsw/benchmarks/benchmark_script.py index 3241e13..21ca940 100644 --- a/algorithms/GA/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/GA/hnsw/benchmarks/benchmark_script.py @@ -303,7 +303,26 @@ def download_file(url, dst): if args.dataset == 'sift' and not os.path.exists(SIFT_DIR): download_file("ftp://ftp.irisa.fr/local/texmex/corpus/sift.tar.gz", "datasets") with tarfile.open("datasets/sift.tar.gz") as t: - t.extractall(path="datasets") + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(t, path="datasets") subprocess.call("python datasets/convert_texmex_fvec.py datasets/sift/sift_base.fvecs >> datasets/sift.txt", shell=True) if args.dataset == 'youtube' and not os.path.exists(YOUTUBE_DIR): diff --git a/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py b/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py index 3241e13..21ca940 100644 --- a/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py @@ -303,7 +303,26 @@ def download_file(url, dst): if args.dataset == 'sift' and not os.path.exists(SIFT_DIR): download_file("ftp://ftp.irisa.fr/local/texmex/corpus/sift.tar.gz", "datasets") with tarfile.open("datasets/sift.tar.gz") as t: - t.extractall(path="datasets") + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(t, path="datasets") subprocess.call("python datasets/convert_texmex_fvec.py datasets/sift/sift_base.fvecs >> datasets/sift.txt", shell=True) if args.dataset == 'youtube' and not os.path.exists(YOUTUBE_DIR): diff --git a/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py b/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py index 3241e13..21ca940 100644 --- a/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py @@ -303,7 +303,26 @@ def download_file(url, dst): if args.dataset == 'sift' and not os.path.exists(SIFT_DIR): download_file("ftp://ftp.irisa.fr/local/texmex/corpus/sift.tar.gz", "datasets") with tarfile.open("datasets/sift.tar.gz") as t: - t.extractall(path="datasets") + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(t, path="datasets") subprocess.call("python datasets/convert_texmex_fvec.py datasets/sift/sift_base.fvecs >> datasets/sift.txt", shell=True) if args.dataset == 'youtube' and not os.path.exists(YOUTUBE_DIR): From e2a46308b0eba060b5fb14909e21af9dc441d3c6 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Tue, 4 Oct 2022 20:05:03 +0000 Subject: [PATCH 2/2] Adding numeric_owner as keyword arguement --- algorithms/GA/hnsw/benchmarks/benchmark_script.py | 2 +- algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py | 2 +- algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/algorithms/GA/hnsw/benchmarks/benchmark_script.py b/algorithms/GA/hnsw/benchmarks/benchmark_script.py index 21ca940..ef03677 100644 --- a/algorithms/GA/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/GA/hnsw/benchmarks/benchmark_script.py @@ -319,7 +319,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(t, path="datasets") diff --git a/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py b/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py index 21ca940..ef03677 100644 --- a/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/TOGG-KDT/hnsw/benchmarks/benchmark_script.py @@ -319,7 +319,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(t, path="datasets") diff --git a/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py b/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py index 21ca940..ef03677 100644 --- a/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py +++ b/algorithms/TOGG-KMC/hnsw/benchmarks/benchmark_script.py @@ -319,7 +319,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(t, path="datasets")