diff --git a/custom_tensorflow_keras_nlp/util/preprocessing.py b/custom_tensorflow_keras_nlp/util/preprocessing.py index 15be934..e6ba555 100644 --- a/custom_tensorflow_keras_nlp/util/preprocessing.py +++ b/custom_tensorflow_keras_nlp/util/preprocessing.py @@ -27,7 +27,26 @@ def download_dataset(): with tarfile.open("data/ag_news_csv.tgz", 'r:gz') as tar: print("Unzipping...") - tar.extractall(path="data/") + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path="data/") tar.close() try: # Clean up the noise in the folder, don't care too much if it fails: diff --git a/pytorch_alternatives/custom_pytorch_nlp/util/preprocessing.py b/pytorch_alternatives/custom_pytorch_nlp/util/preprocessing.py index 74267e9..acb58f6 100644 --- a/pytorch_alternatives/custom_pytorch_nlp/util/preprocessing.py +++ b/pytorch_alternatives/custom_pytorch_nlp/util/preprocessing.py @@ -29,7 +29,26 @@ def download_dataset(): ) with tarfile.open("data/ag_news_csv.tgz", 'r:gz') as tar: print("Unzipping...") - tar.extractall(path="data/") + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path="data/") tar.close() try: # Clean up the noise in the folder, don't care too much if it fails: