diff --git a/Miniconda2/Lib/site-packages/conda/gateways/disk/create.py b/Miniconda2/Lib/site-packages/conda/gateways/disk/create.py index 5adbd79c..3d8b5bbc 100644 --- a/Miniconda2/Lib/site-packages/conda/gateways/disk/create.py +++ b/Miniconda2/Lib/site-packages/conda/gateways/disk/create.py @@ -104,7 +104,26 @@ def extract_tarball(tarball_full_path, destination_directory=None): assert not lexists(destination_directory), destination_directory with tarfile.open(tarball_full_path) as t: - t.extractall(path=destination_directory) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(t, path=destination_directory) if sys.platform.startswith('linux') and os.getuid() == 0: # When extracting as root, tarfile will by restore ownership # of extracted files. However, we want root to be the owner diff --git a/Miniconda3/Lib/tarfile.py b/Miniconda3/Lib/tarfile.py index edd31e96..465e7467 100644 --- a/Miniconda3/Lib/tarfile.py +++ b/Miniconda3/Lib/tarfile.py @@ -2498,7 +2498,26 @@ def main(): if is_tarfile(src): with TarFile.open(src, 'r:*') as tf: - tf.extractall(path=curdir) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tf, path=curdir) if args.verbose: if curdir == '.': msg = '{!r} file is extracted.'.format(src) diff --git a/README.md b/README.md index 374632d9..05406c6a 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,23 @@ GSV2SVF is designed to interactively calculate sky/tree/building view factors fr The Caffe-SegNet deep convolutional framework is used to classify street images (https://github.com/alexgkendall/caffe-segnet). Python and JavaScript were used to develop the interactive functionality that integrates Caffe-SegNet with Google Maps. The program currently runs only on Windows due to the restriction that the Caffe-SegNet module was compiled on Windows, although it could also be complied on Linux. A NVIDIA graphics card that supports CUDA 7.5 or newer versions is required. It has been tested only on Windows 10. Further efforts are needed to rebuild GSV2SVF for running on Linux. ### 3. Google Maps API license A Google Maps API is needed to explore Google Maps and perform GSV queries. The user may apply for a Google Maps API Key at https://developers.google.com/maps/documentation/javascript/get-api-key. + +To make sure your Google API is working, you can verify by testing +https://maps.googleapis.com/maps/api/streetview/metadata?location=40.7254686,-73.9966184&key=API_KEY +Remember to replace "API_KEY" with your actual Google API Key. +If it works, you should be able to see response in the following structure: +```json +{ + "copyright" : "© Google", + "date" : "2019-06", + "location" : { + "lat" : 40.7254686, + "lng" : -73.9966184 + }, + "pano_id" : "zI-rBAALNiHzRTwczq7XDg", + "status" : "OK" +} +``` ### 4. Configuration Open the configuration table Config.csv in the root. The table consists of two columns: the variable names (APIKey, Lat, Lon, CUDA) are laid out in the first column with their respective values stored in the second column. Enter your Google Maps API Key and optionally the startup map location in the second column. ### 5. Run GSV2SVF (Run.bat)