10000 Fixed multiple tar slips from using "extractall" which can lead to an exploit by awiswasi · Pull Request #23163 · scikit-learn/scikit-learn · GitHub
[go: up one dir, main page]
Skip to content

Fixed multiple tar slips from using "extractall" which can lead to an exploit #23163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Fixed multiple tar slips from using "extractall" which can lead to an exploit #23163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d638494
Fixed multiple tar slips from using extractall() that could cause exp…
awiswasi Apr 19, 2022
185446d
Update plot_out_of_core_classification.py
awiswasi Apr 19, 2022
a71c4ea
Update _lfw.py
awiswasi Apr 19, 2022
b70baa7
Update _twenty_newsgroups.py
awiswasi Apr 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion examples/applications/plot_out_of_core_classification.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
# @FedericoV <https://github.com/FedericoV/>
# License: BSD 3 clause

from contextlib import closing
from glob import glob
import itertools
import os.path
Expand Down Expand Up @@ -169,7 +170,9 @@ def progress(blocknum, bs, size):
if _not_in_sphinx():
sys.stdout.write("\r")
print("untarring Reuters dataset...")
tarfile.open(archive_path, "r:gz").extractall(data_path)
# extractall can cause a tar slip
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From #23163 (comment), this does not actually prevent the exploit:

Suggested change
# extractall can cause a tar slip

This applies to the other diffs as well.

with closing(tarfile.open(archive_path, "r:gz")) as archive:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the Tarfile docs

A TarFile object can be used as a context manager in a with statement. It will automatically be closed when the block is completed.

Suggested change
with closing(tarfile.open(archive_path, "r:gz")) as archive:
with tarfile.open(archive_path, "r:gz") as archive:

This comment applies to the other diffs as well.

archive.extractall(path=data_path)
print("done.")

parser = ReutersParser()
Expand Down
5 changes: 4 additions & 1 deletion sklearn/datasets/_lfw.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
# Copyright (c) 2011 Olivier Grisel <olivier.grisel@ensta.org>
# License: BSD 3 clause

from contextlib import closing
from os import listdir, makedirs, remove
from os.path import join, exists, isdir

Expand Down Expand Up @@ -108,7 +109,9 @@ def _check_fetch_lfw(data_home=None, funneled=True, download_if_missing=True):
import tarfile

logger.debug("Decompressing the data archive to %s", data_folder_path)
tarfile.open(archive_path, "r:gz").extractall(path=lfw_home)
# extractall can cause a tar slip
with closing(tarfile.open(archive_path, "r:gz")) as archive:
archive.extractall(path=lfw_home)
remove(archive_path)

return lfw_home, data_folder_path
Expand Down
5 changes: 4 additions & 1 deletion sklearn/datasets/_twenty_newsgroups.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
# Copyright (c) 2011 Olivier Grisel <olivier.grisel@ensta.org>
# License: BSD 3 clause

from contextlib import closing
import os
import logging
import tarfile
Expand Down Expand Up @@ -74,7 +75,9 @@ def _download_20newsgroups(target_dir, cache_path):
archive_path = _fetch_remote(ARCHIVE, dirname=target_dir)

logger.debug("Decompressing %s", archive_path)
tarfile.open(archive_path, "r:gz").extractall(path=target_dir)
# extractall can cause a tar slip
with closing(tarfile.open(archive_path, "r:gz")) as archive:
archive.extractall(path=target_dir)
os.remove(archive_path)

# Store a zipped pickle
Expand Down
0