Rebase patch for CVE-2007-4559
This commit is contained in:
parent
579c990d37
commit
26ebeb19b2
@ -1,9 +1,20 @@
|
|||||||
Minimal patch for pip
|
From 1819805f2019c731bcaefd6b12fd814790f88fcd Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lumir Balhar <lbalhar@redhat.com>
|
||||||
|
Date: Tue, 19 Mar 2024 12:43:07 +0100
|
||||||
|
Subject: [PATCH] cve-2007-4559-tarfile
|
||||||
|
|
||||||
diff -rU3 pip-orig/src/pip/_internal/utils/unpacking.py pip/src/pip/_internal/utils/unpacking.py
|
Minimal patch for pip
|
||||||
--- pip-orig/src/pip/_internal/utils/unpacking.py 2022-11-05 16:25:43.000000000 +0100
|
---
|
||||||
+++ pip/src/pip/_internal/utils/unpacking.py 2023-08-08 13:17:47.705613554 +0200
|
src/pip/_internal/utils/unpacking.py | 7 +++++++
|
||||||
@@ -184,6 +184,13 @@
|
src/pip/_vendor/distlib/util.py | 13 +++++++++++++
|
||||||
|
tests/unit/test_utils_unpacking.py | 17 +++++++++++++++++
|
||||||
|
3 files changed, 37 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py
|
||||||
|
index 5f63f97..c31542f 100644
|
||||||
|
--- a/src/pip/_internal/utils/unpacking.py
|
||||||
|
+++ b/src/pip/_internal/utils/unpacking.py
|
||||||
|
@@ -184,6 +184,13 @@ def untar_file(filename: str, location: str) -> None:
|
||||||
"outside target directory ({})"
|
"outside target directory ({})"
|
||||||
)
|
)
|
||||||
raise InstallationError(message.format(filename, path, location))
|
raise InstallationError(message.format(filename, path, location))
|
||||||
@ -17,15 +28,36 @@ diff -rU3 pip-orig/src/pip/_internal/utils/unpacking.py pip/src/pip/_internal/ut
|
|||||||
if member.isdir():
|
if member.isdir():
|
||||||
ensure_dir(path)
|
ensure_dir(path)
|
||||||
elif member.issym():
|
elif member.issym():
|
||||||
|
diff --git a/src/pip/_vendor/distlib/util.py b/src/pip/_vendor/distlib/util.py
|
||||||
|
index 80bfc86..7e0941a 100644
|
||||||
|
--- a/src/pip/_vendor/distlib/util.py
|
||||||
|
+++ b/src/pip/_vendor/distlib/util.py
|
||||||
|
@@ -1249,6 +1249,19 @@ def unarchive(archive_filename, dest_dir, format=None, check=True):
|
||||||
|
for tarinfo in archive.getmembers():
|
||||||
|
if not isinstance(tarinfo.name, text_type):
|
||||||
|
tarinfo.name = tarinfo.name.decode('utf-8')
|
||||||
|
+
|
||||||
|
+ # Limit extraction of dangerous items, if this Python
|
||||||
|
+ # allows it easily. If not, just trust the input.
|
||||||
|
+ # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
|
||||||
|
+ def extraction_filter(member, path):
|
||||||
|
+ """Run tarfile.tar_fillter, but raise the expected ValueError"""
|
||||||
|
+ # This is only called if the current Python has tarfile filters
|
||||||
|
+ try:
|
||||||
|
+ return tarfile.tar_filter(member, path)
|
||||||
|
+ except tarfile.FilterError as exc:
|
||||||
|
+ raise ValueError(str(exc))
|
||||||
|
+ archive.extraction_filter = extraction_filter
|
||||||
|
+
|
||||||
|
archive.extractall(dest_dir)
|
||||||
|
|
||||||
|
finally:
|
||||||
Test from https://github.com/pypa/pip/pull/12214
|
diff --git a/tests/unit/test_utils_unpacking.py b/tests/unit/test_utils_unpacking.py
|
||||||
|
index ccb7a30..05324ad 100644
|
||||||
diff -rU3 pip-orig/tests/unit/test_utils_unpacking.py pip/tests/unit/test_utils_unpacking.py
|
--- a/tests/unit/test_utils_unpacking.py
|
||||||
--- pip-orig/tests/unit/test_utils_unpacking.py 2022-11-05 16:25:43.000000000 +0100
|
+++ b/tests/unit/test_utils_unpacking.py
|
||||||
+++ pip/tests/unit/test_utils_unpacking.py 2023-08-08 13:17:35.151540108 +0200
|
@@ -171,6 +171,23 @@ class TestUnpackArchives:
|
||||||
@@ -167,6 +167,23 @@
|
test_tar = self.make_tar_file("test_tar.tar", files)
|
||||||
test_tar = self.make_tar_file('test_tar.tar', files)
|
|
||||||
untar_file(test_tar, self.tempdir)
|
untar_file(test_tar, self.tempdir)
|
||||||
|
|
||||||
+ def test_unpack_tar_filter(self) -> None:
|
+ def test_unpack_tar_filter(self) -> None:
|
||||||
@ -46,33 +78,8 @@ diff -rU3 pip-orig/tests/unit/test_utils_unpacking.py pip/tests/unit/test_utils_
|
|||||||
+
|
+
|
||||||
+
|
+
|
||||||
|
|
||||||
def test_unpack_tar_unicode(tmpdir):
|
def test_unpack_tar_unicode(tmpdir: Path) -> None:
|
||||||
test_tar = tmpdir / "test.tar"
|
test_tar = tmpdir / "test.tar"
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
|
|
||||||
Patch for vendored distlib from https://github.com/pypa/distlib/pull/201
|
|
||||||
|
|
||||||
diff --git a/distlib/util.py b/distlib/util.py
|
|
||||||
index e0622e4..4349d0b 100644
|
|
||||||
--- a/src/pip/_vendor/distlib/util.py
|
|
||||||
+++ b/src/pip/_vendor/distlib/util.py
|
|
||||||
@@ -1249,6 +1249,19 @@ def check_path(path):
|
|
||||||
for tarinfo in archive.getmembers():
|
|
||||||
if not isinstance(tarinfo.name, text_type):
|
|
||||||
tarinfo.name = tarinfo.name.decode('utf-8')
|
|
||||||
+
|
|
||||||
+ # Limit extraction of dangerous items, if this Python
|
|
||||||
+ # allows it easily. If not, just trust the input.
|
|
||||||
+ # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
|
|
||||||
+ def extraction_filter(member, path):
|
|
||||||
+ """Run tarfile.tar_fillter, but raise the expected ValueError"""
|
|
||||||
+ # This is only called if the current Python has tarfile filters
|
|
||||||
+ try:
|
|
||||||
+ return tarfile.tar_filter(member, path)
|
|
||||||
+ except tarfile.FilterError as exc:
|
|
||||||
+ raise ValueError(str(exc))
|
|
||||||
+ archive.extraction_filter = extraction_filter
|
|
||||||
+
|
|
||||||
archive.extractall(dest_dir)
|
|
||||||
|
|
||||||
finally:
|
|
||||||
|
Loading…
Reference in New Issue
Block a user