Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate potential issue reported by bandit #694

Open
enzbang opened this issue Mar 20, 2024 · 4 comments
Open

Investigate potential issue reported by bandit #694

enzbang opened this issue Mar 20, 2024 · 4 comments
Assignees
@grouigrokon

Comments

@enzbang
Copy link
Member

enzbang commented Mar 20, 2024

See https://bandit.readthedocs.io/en/1.7.8/plugins/b202_tarfile_unsafe_members.html
@enzbang
Copy link
Member Author

enzbang commented Jul 9, 2024

One simple fix starting with Python 3.12 would be to use the extraction filter "data". This will be the default in Python 3.14.

The question is whether we need to make it configurable or not. Do we have legitimate use case of a different extraction filter?

See https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter

@grouigrokon grouigrokon self-assigned this Sep 26, 2024
@grouigrokon
Copy link
Contributor

I have a testcase which reproduces the issue. Working on a fix.

adacore-bot pushed a commit that referenced this issue Oct 24, 2024
@grouigrokon
Handle tarfile.extractall() issue
31ee075 
As reported by `bandit` B202 handler, the `tarfile.extractall()` method
is not safe with some file paths.

We previously ignored this handler, and decided to handle things in
the `e3.archive` module now. The  `tarfile.data_filter()` is now used
when it exists, and a fallback handling absolute paths and traversal
paths has been created.

Ref: #694
@grouigrokon
Copy link
Contributor

Issue should be fixed by the commit mentioned above: 31ee075

@grouigrokon
Copy link
Contributor

We had to revert the commit because of a bug in tarfile.data_filters.

@grouigrokon grouigrokon reopened this Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@grouigrokon grouigrokon

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@enzbang @grouigrokon