Ticket #27659: patch.diff

django/utils/archive.py

@@ -27 +27 @@
 import zipfile
 
 from django.utils import six
+from django.utils._os import safe_join
 
 
 class ArchiveException(Exception):
@@ -146 +147 @@
             name = member.name
             if leading:
                 name = self.split_leading_dir(name)[1]
-            filename = os.path.join(to_path, name)
+            filename = safe_join(to_path, name)
             if member.isdir():
                 if filename and not os.path.exists(filename):
                     os.makedirs(filename)
@@ -187 +188 @@
             data = self._archive.read(name)
             if leading:
                 name = self.split_leading_dir(name)[1]
-            filename = os.path.join(to_path, name)
+            if not name:
+                continue
+            filename = safe_join(to_path, name)
             dirname = os.path.dirname(filename)
             if dirname and not os.path.exists(dirname):
                 os.makedirs(dirname)
-            if filename.endswith(('/', '\\')):
+            if name.endswith(('/', '\\')):
                 # A directory
                 if not os.path.exists(filename):
                     os.makedirs(filename)

tests/utils_tests/test_archive.py

@@ -3 +3 @@
 import tempfile
 import unittest
 
+from django.core.exceptions import SuspiciousFileOperation
 from django.utils._os import upath
 from django.utils.archive import Archive, extract
 
@@ -60 +61 @@
         self.assertTrue(os.path.isfile(os.path.join(self.tmpdir, 'foo', 'bar', '2')))
 
 
+class TestSafeUnarchival(unittest.TestCase):
+
+    def setUp(self):
+        """
+        Create temporary directory for testing extraction.
+        """
+        self.old_cwd = os.getcwd()
+        self.tmpdir = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.tmpdir)
+        # Always start off in TEST_DIR.
+        os.chdir(TEST_DIR)
+
+    def test_absolute_path(self):
+        path = os.path.join(TEST_DIR, 'absolute.tar')
+        with self.assertRaises(SuspiciousFileOperation):
+            extract(path)
+
+    def test_no_dotdot_in_path(self):
+        path = os.path.join(TEST_DIR, 'dotdot.tar')
+        with self.assertRaises(SuspiciousFileOperation):
+            extract(path)
+
+
 class TestZip(ArchiveTester, unittest.TestCase):
     archive = 'foobar.zip'