Fix tarfile security issue

3liz · Dec 21, 2023 · d2d126c · d2d126c
1 parent 58e9e43
commit d2d126c
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/cadastre/cadastre_import.py b/cadastre/cadastre_import.py
@@ -1009,7 +1009,12 @@ def unzipFolderContent(self, path):
                 for z in tarFileListA:
                     with tarfile.open(z) as t:
                         try:
-                            t.extractall(os.path.join(self.edigeoPlainDir, 'tar_%s' % i))
+                            # See https://docs.python.org/3.8/library/tarfile.html#tarfile.TarFile.extractall
+                            # See https://peps.python.org/pep-0706/
+                            t.extractall(
+                                os.path.join(self.edigeoPlainDir, 'tar_%s' % i),
+                                filter='data',
+                            )
                         except tarfile.ReadError:
                             # Issue GitHub #339
                             self.go = False