Skip to content

Commit 292d7d8

Browse files
authored
Update utils.py
Sorry... I chose the wrong branch before. I added some anti-bypass measures to make the decompression operation safer. Signed-off-by: h3rrr <[email protected]>
1 parent f793740 commit 292d7d8

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

monai/apps/utils.py

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,11 @@ def safe_extract_member(member, extract_to):
130130
else:
131131
member_path = str(member)
132132

133+
if hasattr(member, 'issym') and member.issym():
134+
raise ValueError(f"Symbolic link detected in archive: {member_path}")
135+
if hasattr(member, 'islnk') and member.islnk():
136+
raise ValueError(f"Hard link detected in archive: {member_path}")
137+
133138
member_path = os.path.normpath(member_path)
134139

135140
if os.path.isabs(member_path) or '..' in member_path.split(os.sep):
@@ -313,9 +318,10 @@ def extractall(
313318
if filepath.name.endswith("zip") or _file_type == "zip":
314319
with zipfile.ZipFile(filepath, 'r') as zip_file:
315320
for member in zip_file.infolist():
321+
safe_path = safe_extract_member(member, output_dir)
316322
if member.is_dir():
317323
continue
318-
safe_path = safe_extract_member(member, output_dir)
324+
319325
os.makedirs(os.path.dirname(safe_path), exist_ok=True)
320326
with zip_file.open(member) as source:
321327
with open(safe_path, 'wb') as target:
@@ -324,9 +330,10 @@ def extractall(
324330
if filepath.name.endswith("tar") or filepath.name.endswith("tar.gz") or "tar" in _file_type:
325331
with tarfile.open(filepath, 'r') as tar_file:
326332
for member in tar_file.getmembers():
333+
safe_path = safe_extract_member(member, output_dir)
327334
if not member.isfile():
328335
continue
329-
safe_path = safe_extract_member(member, output_dir)
336+
330337
os.makedirs(os.path.dirname(safe_path), exist_ok=True)
331338
source = tar_file.extractfile(member)
332339
if source is not None:

0 commit comments

Comments
 (0)