diff --git a/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/contrib/text/embedding.py b/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/contrib/text/embedding.py index 9d529db7..22306d0f 100644 --- a/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/contrib/text/embedding.py +++ b/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/contrib/text/embedding.py @@ -226,7 +226,26 @@ def _get_pretrained_file(cls, embedding_root, pretrained_file_name): zf.extractall(embedding_dir) elif ext == '.gz': with tarfile.open(downloaded_file_path, 'r:gz') as tar: - tar.extractall(path=embedding_dir) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path=embedding_dir) return pretrained_file_path def _load_embedding(self, pretrained_file_path, elem_delim, init_unknown_vec, encoding='utf8'): diff --git a/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/gluon/data/vision/datasets.py b/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/gluon/data/vision/datasets.py index 12ef7e16..ea44ff4f 100644 --- a/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/gluon/data/vision/datasets.py +++ b/python_deep_learning_icp3/venv/lib/python3.6/site-packages/mxnet/gluon/data/vision/datasets.py @@ -172,7 +172,26 @@ def _get_data(self): sha1_hash=self._archive_file[1]) with tarfile.open(filename) as tar: - tar.extractall(self._root) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, self._root) if self._train: data_files = self._train_data