From e2c4dbf721aca11e8010063ef69dd1e35fd9945a Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 5 Jul 2022 15:30:10 +0200 Subject: [PATCH] Show a scary message in case of path traversal attempt --- libmat2/archive.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/libmat2/archive.py b/libmat2/archive.py index 31d97a0..f90385b 100644 --- a/libmat2/archive.py +++ b/libmat2/archive.py @@ -193,14 +193,24 @@ class ArchiveBasedAbstractParser(abstract.AbstractParser): zin.extract(member=item, path=temp_folder) full_path = os.path.join(temp_folder, member_name) - original_permissions = os.stat(full_path).st_mode + try: + original_permissions = os.stat(full_path).st_mode + except FileNotFoundError: + logging.error("Something went wrong during processing of " + "%s in %s, likely a path traversal attack.", + member_name, self.filename) + abort = True + # we're breaking instead of continuing, because this exception + # is raised in case of weird path-traversal-like atttacks. + break + os.chmod(full_path, original_permissions | stat.S_IWUSR | stat.S_IRUSR) original_compression = self._get_member_compression(item) if self._specific_cleanup(full_path) is False: - logging.warning("Something went wrong during deep cleaning of %s", - member_name) + logging.warning("Something went wrong during deep cleaning of %s in %s", + member_name, self.filename) abort = True continue