CC/gpt_academic
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

raise error when the uploaded tar contain hard/soft link (#2136)

Browse Source
This commit is contained in:
binary-husky
2025-02-08 20:54:01 +08:00
committed by GitHub
parent 991a903fa9
commit 07ece29c7c
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
shared_utils/handle_upload.py
View File

@@ -111,6 +111,8 @@ def extract_archive(file_path, dest_dir):
member_path = os.path.normpath(member.name) member_path = os.path.normpath(member.name)
full_path = os.path.join(dest_dir, member_path) full_path = os.path.join(dest_dir, member_path)
full_path = os.path.abspath(full_path) full_path = os.path.abspath(full_path)
if member.islnk() or member.issym():
raise Exception(f"Attempted Symlink in {member.name}")
if not full_path.startswith(os.path.abspath(dest_dir) + os.sep): if not full_path.startswith(os.path.abspath(dest_dir) + os.sep):
raise Exception(f"Attempted Path Traversal in {member.name}") raise Exception(f"Attempted Path Traversal in {member.name}")