sascha/workload-automation
1
0
Fork 0
mirror of https://github.com/ARM-software/workload-automation.git synced 2025-09-02 19:32:34 +01:00
Code Issues Releases Wiki Activity

Mitigate CVE-2007-4995

Browse Source 
Prevent potential directory path traversal attacks (see
https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html)
This commit is contained in:
Marc Bonnici
2022-12-21 16:17:35 +00:00
parent 5e0c59babb
commit 3228a3187c
5 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
wa/instruments/misc.py
View File

@@ -37,7 +37,7 @@ from wa import Instrument, Parameter, very_fast
from wa.framework.exception import ConfigError
from wa.framework.instrument import slow
from wa.utils.diff import diff_sysfs_dirs, diff_interrupt_files
from wa.utils.misc import as_relative
from wa.utils.misc import as_relative, safe_extract
from wa.utils.misc import ensure_file_directory_exists as _f
from wa.utils.misc import ensure_directory_exists as _d
from wa.utils.types import list_of_strings
@@ -162,7 +162,7 @@ class SysfsExtractor(Instrument):
self.target.execute('chmod 0777 {}'.format(on_device_tarball), as_root=True)
self.target.pull(on_device_tarball, on_host_tarball)
with tarfile.open(on_host_tarball, 'r:gz') as tf:
tf.extractall(context.output_directory)
safe_extract(tf, context.output_directory)
self.target.remove(on_device_tarball)
os.remove(on_host_tarball)