sascha/workload-automation
1
0
Fork 0
mirror of https://github.com/ARM-software/workload-automation.git synced 2025-09-02 11:22:41 +01:00
Code Issues Releases Wiki Activity

Mitigate CVE-2007-4995

Browse Source 
Prevent potential directory path traversal attacks (see
https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html)
This commit is contained in:
Marc Bonnici
2022-12-21 16:17:35 +00:00
parent 5e0c59babb
commit 3228a3187c
5 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
wa/framework/output.py
View File

@@ -39,7 +39,8 @@ from wa.framework.run import RunState, RunInfo
from wa.framework.target.info import TargetInfo
from wa.framework.version import get_wa_version_with_commit
from wa.utils.doc import format_simple_table
from wa.utils.misc import touch, ensure_directory_exists, isiterable, format_ordered_dict
from wa.utils.misc import (touch, ensure_directory_exists, isiterable,
format_ordered_dict, safe_extract)
from wa.utils.postgres import get_schema_versions
from wa.utils.serializer import write_pod, read_pod, Podable, json
from wa.utils.types import enum, numeric
@@ -854,7 +855,7 @@ class DatabaseOutput(Output):
def _read_dir_artifact(self, artifact):
artifact_path = tempfile.mkdtemp(prefix='wa_')
with tarfile.open(fileobj=self.conn.lobject(int(artifact.path), mode='b'), mode='r|gz') as tar_file:
tar_file.extractall(artifact_path)
safe_extract(tar_file, artifact_path)
self.conn.commit()
return artifact_path