tarfile insecure pathname extraction

[gustaebel]

BPO	1044
Nosy	@doko42, @gustaebel, @taleinat, @matejcik
Files	insecure_pathnames.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/gustaebel'
closed_at = <Date 2007-08-30.20:28:31.686>
created_at = <Date 2007-08-28.10:09:24.558>
labels = ['type-bug', 'library']
title = 'tarfile insecure pathname extraction'
updated_at = <Date 2018-08-27.18:45:41.050>
user = 'https://github.com/gustaebel'

bugs.python.org fields:

activity = <Date 2018-08-27.18:45:41.050>
actor = 'taleinat'
assignee = 'lars.gustaebel'
closed = True
closed_date = <Date 2007-08-30.20:28:31.686>
closer = 'lars.gustaebel'
components = ['Library (Lib)']
creation = <Date 2007-08-28.10:09:24.558>
creator = 'lars.gustaebel'
dependencies = []
files = ['8339']
hgrepos = []
issue_num = 1044
keywords = ['patch']
message_count = 6.0
messages = ['55361', '55362', '55365', '55464', '55489', '55509']
nosy_count = 4.0
nosy_names = ['doko', 'lars.gustaebel', 'taleinat', 'matejcik']
pr_nums = []
priority = 'normal'
resolution = 'works for me'
stage = None
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue1044'
versions = ['Python 2.6']

[gustaebel]

tarfile does not check pathnames or linknames on extraction. This can
lead to data loss or attack scenarios when members with absolute
pathnames or pathnames outside of the archive's scope overwrite or
overlay existing files or directories.

Example for a symlink attack against /etc/passwd:

foo -> /etc
foo/passwd

[matejcik]

no change to extract() ?

otherwise looks good to me. if you don't object, i am applying this to
SUSE's python 2.5

[gustaebel]

In principle I do not object, but this is a preliminary patch. I am
still not happy with the naming of the "check_paths" argument. Also, the
patch was made against the trunk which means that it contains hunks with
the new reStructuredText documentation. Please be patient.

I do not change extract() because it has become more and more a
low-level method over the years, that makes promises it cannot keep and
should not be used at all. I try to discourage its use in the documentation.

[gustaebel]

After careful consideration and a private discussion with Martin I do no
longer think that we have a security issue here. tarfile.py does nothing
wrong, its behaviour conforms to the pax definition and pathname
resolution guidelines in POSIX. There is no known or possible practical
exploit.

I update the documentation with a warning, that it might be dangerous to
extract archives from untrusted sources. That is the only thing to be
done IMO.

[matejcik]

if that can be considered "official stance", it's fine by me. feel free
to close the bug.

[gustaebel]

I updated the documentation, r57764 (trunk) and r57765 (2.5).

[sailinggalaxians]

Has anyone seen this?

https://www.information-age.com/350000-open-source-projects-at-risk-due-to-15-year-old-vulnerability-123500024/

If so, what's been done so far?
Seems no official patches are released.
I could be wrong though.

[dgw]

Doing something you shouldn't with untrusted input isn't the language's fault.