From db20e201f9a804317cdbb530143ffdbe77472006 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Sat, 1 Oct 2022 00:32:36 +0000 Subject: [PATCH 1/2] Adding tarfile member sanitization to extractall() --- frontend/mate/mate/build/build.py | 21 ++++++++++++++- frontend/mate/mate/build/compile.py | 42 +++++++++++++++++++++++++++-- 2 files changed, 60 insertions(+), 3 deletions(-) diff --git a/frontend/mate/mate/build/build.py b/frontend/mate/mate/build/build.py index c4f7fe0..55fe6f7 100644 --- a/frontend/mate/mate/build/build.py +++ b/frontend/mate/mate/build/build.py @@ -670,7 +670,26 @@ def _attach_source_lines_to_nodes(self, session: orm.Session) -> None: # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it? local_artifact = source_artifact.persist_locally(suffix=".tar.gz") with tarfile.open(local_artifact, "r:gz") as tar: - tar.extractall(path=temp_source_dir.name) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, path=temp_source_dir.name) source_dir = Path(temp_source_dir.name) elif source_artifact.kind == ArtifactKind.CompileTargetBrokeredChallenge: local_artifact = source_artifact.persist_locally(suffix=".zip") diff --git a/frontend/mate/mate/build/compile.py b/frontend/mate/mate/build/compile.py index ca0ebab..7e07d2f 100644 --- a/frontend/mate/mate/build/compile.py +++ b/frontend/mate/mate/build/compile.py @@ -710,7 +710,26 @@ def _compile_tarball_local(self, artifact: db.Artifact) -> None: try: # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it? with tarfile.open(local_target, "r:gz") as tar: - tar.extractall(path=local_target_dir.name) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, path=local_target_dir.name) except tarfile.TarError as e: self._raise( f"failed to open/extract tarball: {e}", @@ -785,7 +804,26 @@ def _compile_tarball_containerized(self, artifact: db.Artifact) -> None: local_target = artifact.persist_locally(suffix=".tar.gz") try: with tarfile.open(local_target, "r:gz") as tar: - tar.extractall(path=scratch_src) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, path=scratch_src) except tarfile.TarError as e: self._raise( "failed to open/extract tarball", From 26e73e17795d861f77c6ebcc0e71478ed70ffe66 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Tue, 4 Oct 2022 01:29:52 +0000 Subject: [PATCH 2/2] Adding numeric_owner as keyword arguement --- frontend/mate/mate/build/build.py | 2 +- frontend/mate/mate/build/compile.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/frontend/mate/mate/build/build.py b/frontend/mate/mate/build/build.py index 55fe6f7..03058e5 100644 --- a/frontend/mate/mate/build/build.py +++ b/frontend/mate/mate/build/build.py @@ -686,7 +686,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, path=temp_source_dir.name) diff --git a/frontend/mate/mate/build/compile.py b/frontend/mate/mate/build/compile.py index 7e07d2f..9e2b7b3 100644 --- a/frontend/mate/mate/build/compile.py +++ b/frontend/mate/mate/build/compile.py @@ -726,7 +726,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, path=local_target_dir.name) @@ -820,7 +820,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, path=scratch_src)