awsebcli 3.27.2__tar.gz → 3.27.3__tar.gz

{awsebcli-3.27.2 → awsebcli-3.27.3}/CHANGES.rst

@@ -1,5 +1,10 @@
 Changelog
 =========
+--------------------
+3.27.3 (2026-06-29)
+--------------------
+- Fix path traversal vulnerability in zip extraction for ``eb labs download`` and ``eb create``
+
 --------------------
 3.27.2 (2026-05-13)
 --------------------

{awsebcli-3.27.2/awsebcli.egg-info → awsebcli-3.27.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: awsebcli
-Version: 3.27.2
+Version: 3.27.3
 Summary: Command Line Interface for AWS EB.
 Home-page: http://aws.amazon.com/elasticbeanstalk/
 Author: AWS Elastic Beanstalk
@@ -44,6 +44,7 @@ Dynamic: classifier
 Dynamic: description
 Dynamic: home-page
 Dynamic: license
+Dynamic: license-file
 Dynamic: provides-extra
 Dynamic: requires-dist
 Dynamic: summary
@@ -126,6 +127,11 @@ in the *AWS Elastic Beanstalk Developer Guide*.
 
 Changelog
 =========
+--------------------
+3.27.3 (2026-06-29)
+--------------------
+- Fix path traversal vulnerability in zip extraction for ``eb labs download`` and ``eb create``
+
 --------------------
 3.27.2 (2026-05-13)
 --------------------

{awsebcli-3.27.2 → awsebcli-3.27.3/awsebcli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: awsebcli
-Version: 3.27.2
+Version: 3.27.3
 Summary: Command Line Interface for AWS EB.
 Home-page: http://aws.amazon.com/elasticbeanstalk/
 Author: AWS Elastic Beanstalk
@@ -44,6 +44,7 @@ Dynamic: classifier
 Dynamic: description
 Dynamic: home-page
 Dynamic: license
+Dynamic: license-file
 Dynamic: provides-extra
 Dynamic: requires-dist
 Dynamic: summary
@@ -126,6 +127,11 @@ in the *AWS Elastic Beanstalk Developer Guide*.
 
 Changelog
 =========
+--------------------
+3.27.3 (2026-06-29)
+--------------------
+- Fix path traversal vulnerability in zip extraction for ``eb labs download`` and ``eb create``
+
 --------------------
 3.27.2 (2026-05-13)
 --------------------

{awsebcli-3.27.2 → awsebcli-3.27.3}/ebcli/__init__.py

@@ -11,4 +11,4 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
-__version__ = '3.27.2'
+__version__ = '3.27.3'

{awsebcli-3.27.2 → awsebcli-3.27.3}/ebcli/core/fileoperations.py

@@ -40,7 +40,8 @@ from ebcli.resources.strings import prompts, strings
 from ebcli.objects.exceptions import (
     NotInitializedError,
     InvalidSyntaxError,
-    NotFoundError
+    NotFoundError,
+    ValidationError
 )
 from ebcli.core.ebglobals import Constants
 
@@ -482,14 +483,19 @@ def unzip_folder(file_location, directory):
     if not os.path.isdir(directory):
         os.makedirs(directory)
 
-    zip = zipfile.ZipFile(file_location, 'r', allowZip64=True)
-    for cur_file in zip.namelist():
-        if not cur_file.endswith('/'):
-            root, name = os.path.split(cur_file)
-            path = os.path.normpath(os.path.join(directory, root))
-            if not os.path.isdir(path):
-                os.makedirs(path)
-            open(os.path.join(path, name), 'wb').write(zip.read(cur_file))
+    real_directory = os.path.realpath(directory)
+    with zipfile.ZipFile(file_location, 'r', allowZip64=True) as zf:
+        for cur_file in zf.namelist():
+            if not cur_file.endswith('/'):
+                root, name = os.path.split(cur_file)
+                path = os.path.normpath(os.path.join(directory, root))
+                target_file = os.path.realpath(os.path.join(path, name))
+                if not target_file.startswith(real_directory + os.sep):
+                    raise ValidationError(
+                        'Zip entry "{}" would extract outside the target directory'.format(cur_file))
+                if not os.path.isdir(path):
+                    os.makedirs(path)
+                open(os.path.join(path, name), 'wb').write(zf.read(cur_file))
 
 
 def delete_app_file(app_name):

{awsebcli-3.27.2 → awsebcli-3.27.3}/ebcli/operations/createops.py

@@ -12,7 +12,6 @@
 # language governing permissions and limitations under the License.
 import os
 import re
-from zipfile import ZipFile
 
 from cement.utils.misc import minimal_logger
 
@@ -164,7 +163,7 @@ def download_and_extract_sample_app(env_name):
         zip_file_location = '.elasticbeanstalk/.sample_app_download.zip'
         io.echo('INFO: {}'.format(strings['create.downloading_sample_application']))
         download_application_version(url, zip_file_location)
-        ZipFile(zip_file_location, 'r', allowZip64=True).extractall()
+        fileoperations.unzip_folder(zip_file_location, os.getcwd())
         os.remove(zip_file_location)
         io.echo('INFO: {}'.format(strings['create.sample_application_download_complete']))
     except NotAuthorizedError as e: