CVE-2007-4559 Patch

examples/cifar_distributed_cnn/data/download_cifar10.py

@@ -30,7 +30,26 @@ def extract_tarfile(filepath):
     if os.path.exists(filepath):
         print('The tar file does exist. Extracting it now..')
         with tarfile.open(filepath, 'r') as f:
-            f.extractall('/tmp/')
+            def is_within_directory(directory, target):
+
+                abs_directory = os.path.abspath(directory)
+                abs_target = os.path.abspath(target)
+
+                prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                return prefix == abs_directory
+
+            def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                for member in tar.getmembers():
+                    member_path = os.path.join(path, member.name)
+                    if not is_within_directory(path, member_path):
+                        raise Exception("Attempted Path Traversal in Tar File")
+
+                tar.extractall(path, members, numeric_owner=numeric_owner) 
+
+
+            safe_extract(f, "/tmp/")
         print('Finished!')
         sys.exit(0)
 

examples/cnn/data/download_cifar10.py

@@ -30,7 +30,26 @@ def extract_tarfile(filepath):
     if os.path.exists(filepath):
         print('The tar file does exist. Extracting it now..')
         with tarfile.open(filepath, 'r') as f:
-            f.extractall('/tmp/')
+            def is_within_directory(directory, target):
+
+                abs_directory = os.path.abspath(directory)
+                abs_target = os.path.abspath(target)
+
+                prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                return prefix == abs_directory
+
+            def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                for member in tar.getmembers():
+                    member_path = os.path.join(path, member.name)
+                    if not is_within_directory(path, member_path):
+                        raise Exception("Attempted Path Traversal in Tar File")
+
+                tar.extractall(path, members, numeric_owner=numeric_owner) 
+
+
+            safe_extract(f, "/tmp/")
         print('Finished!')
         sys.exit(0)
 

examples/cpp/cifar10/download_data.py

@@ -31,7 +31,26 @@ def extract_tarfile(filepath):
     if os.path.exists(filepath):
         print('The tar file does exist. Extracting it now..')
         with tarfile.open(filepath, 'r') as f:
-            f.extractall('.')
+            def is_within_directory(directory, target):
+
+                abs_directory = os.path.abspath(directory)
+                abs_target = os.path.abspath(target)
+
+                prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                return prefix == abs_directory
+
+            def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                for member in tar.getmembers():
+                    member_path = os.path.join(path, member.name)
+                    if not is_within_directory(path, member_path):
+                        raise Exception("Attempted Path Traversal in Tar File")
+
+                tar.extractall(path, members, numeric_owner=numeric_owner) 
+
+
+            safe_extract(f, ".")
         print('Finished!')
         sys.exit(0)
 

examples/onnx/utils.py

@@ -28,7 +28,26 @@
 def download_model(url):
     download_dir = '/tmp/'
     with tarfile.open(check_exist_or_download(url), 'r') as t:
-        t.extractall(path=download_dir)
+        def is_within_directory(directory, target):
+
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+
+            return prefix == abs_directory
+
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+
+            tar.extractall(path, members, numeric_owner=numeric_owner) 
+
+
+        safe_extract(t, path=download_dir)
 
 
 def load_dataset(test_data_dir):

examples/rnn/imdb_data.py

@@ -108,7 +108,26 @@ def unzip_data(download_dir, data_gz):
     if not os.path.exists(data_dir):
         print("extracting %s to %s" % (download_dir, data_dir))
         with tarfile.open(data_gz) as tar:
-            tar.extractall(download_dir)
+            def is_within_directory(directory, target):
+
+                abs_directory = os.path.abspath(directory)
+                abs_target = os.path.abspath(target)
+
+                prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                return prefix == abs_directory
+
+            def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                for member in tar.getmembers():
+                    member_path = os.path.join(path, member.name)
+                    if not is_within_directory(path, member_path):
+                        raise Exception("Attempted Path Traversal in Tar File")
+
+                tar.extractall(path, members, numeric_owner=numeric_owner) 
+
+
+            safe_extract(tar, download_dir)
     return data_dir