Opened 9 months ago

Last modified 9 months ago

#27659 new Bug

Arbritrary file overrides in startproject/app template extraction

Reported by: Florian Apolloner Owned by: nobody
Component: Utilities Version: master
Severity: Normal Keywords:
Cc: Florian Apolloner Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: yes Patch needs improvement: yes
Easy pickings: no UI/UX: no

Description

Note: This was reported as security issue intially by me, but we think that this is more hardening than an actual issue -- if you are downloading untrusted archives the content can be much worse anyways…

The issue here is that tar files (and probably zip files too), can store full and/or relative paths and therefore escape out of the extraction root.

Attached is an initial WIP to show the issue and possible solution.

Attachments (1)

patch.diff (3.1 KB) - added by Florian Apolloner 9 months ago.

Download all attachments as: .zip

Change History (3)

Changed 9 months ago by Florian Apolloner

Attachment: patch.diff added

comment:1 Changed 9 months ago by Anton Samarchyan

Has patch: set

comment:2 Changed 9 months ago by Florian Apolloner

Needs tests: set
Patch needs improvement: set
Note: See TracTickets for help on using tickets.
Back to Top