Check for CVE-2007-4559

In practice there is little benefit in crafting a TAR that maliciously
overwrites files right before reprounzip executes your code. You can
just be malicious there. Nevertheless, let's do the right thing.

reprounzip/reprounzip/common.py

@@ -348,6 +348,13 @@ def extract_data(self, root, members):
 
         The members must come from get_data().
         """
+        # Check for CVE-2007-4559
+        abs_root = root.absolute()
+        for member in members:
+            member_path = (root / member.name).absolute()
+            if not member_path.lies_under(abs_root):
+                raise ValueError("Invalid path in data tar")
+
         self.data.extractall(str(root), members)
 
     def copy_data_tar(self, target):

reprozip/reprozip/common.py

@@ -348,6 +348,13 @@ def extract_data(self, root, members):
 
         The members must come from get_data().
         """
+        # Check for CVE-2007-4559
+        abs_root = root.absolute()
+        for member in members:
+            member_path = (root / member.name).absolute()
+            if not member_path.lies_under(abs_root):
+                raise ValueError("Invalid path in data tar")
+
         self.data.extractall(str(root), members)
 
     def copy_data_tar(self, target):