Fix arbitrary file write during tarfile extraction in luigi/contrib/lsf_runner.py and luigi/contrib/sge_runner.py #3309
+228
−10
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Ali-Razmjoo
force-pushed
the
fix-tarfile-extraction
branch
from
45f272c to
5850c44
Compare
Ali-Razmjoo
changed the title
Ali-Razmjoo
force-pushed
the
fix-tarfile-extraction
branch
2 times, most recently
from
bd84560 to
89481fe
Compare
dlstadther
requested changes
Sep 5, 2024
Ali-Razmjoo
force-pushed
the
fix-tarfile-extraction
branch
4 times, most recently
from
d7bccbb to
319434a
Compare
Ali-Razmjoo
force-pushed
the
fix-tarfile-extraction
branch
from
319434a to
b012a00
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #3302 and #3301
This pull request introduces a new
SafeExtractorclass to securely handle tar file extraction and replaces the existing tar extraction logic inlsf_runner.pyandsge_runner.pywith this new class. Additionally, it includes tests to validate the functionality ofSafeExtractor.Introduction of
SafeExtractorclass:luigi/safe_extractor.py: Added a newSafeExtractorclass to securely extract tar files and prevent path traversal vulnerabilities. This class ensures that extracted file paths are validated before extraction.Refactoring to use
SafeExtractor:luigi/contrib/lsf_runner.py: Replaced the existing tar extraction logic with theSafeExtractorclass in thedo_work_on_compute_nodeandextract_packages_archivefunctions. [1] [2]luigi/contrib/sge_runner.py: Updated the_do_work_on_compute_nodeand_extract_packages_archivefunctions to use theSafeExtractorclass for tar extraction. [1] [2]Addition of tests for
SafeExtractor:test/contrib/lsf_test.py: Added unit tests for theSafeExtractorclass to ensure it correctly extracts files and handles path traversal attempts. [1] [2]