Skip to content

Commit

Permalink
Merge pull request MuteJester#2 from TrellixVulnTeam/main
Browse files Browse the repository at this point in the history
CVE-2007-4559 Patch Added
Thank you guys for the important notice and contribution.
  • Loading branch information
MuteJester authored Nov 20, 2022
2 parents 25b6fff + 3cb1a84 commit 09c06c5
Showing 1 changed file with 20 additions and 1 deletion.
21 changes: 20 additions & 1 deletion PyNCBI/Utilities.py
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,26 @@ def chunkify(lst, n):
def unzip_tarfile(file,dest_folder):
for f in glob.glob(file):
with tarfile.open(f) as tar:
tar.extractall(dest_folder)
def is_within_directory(directory, target):

abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)

prefix = os.path.commonprefix([abs_directory, abs_target])

return prefix == abs_directory

def safe_extract(tar, path=".", members=None, *, numeric_owner=False):

for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")

tar.extractall(path, members, numeric_owner=numeric_owner)


safe_extract(tar, dest_folder)

def remove_non_idat_files(folder_path):
"""
Expand Down

0 comments on commit 09c06c5

Please sign in to comment.