pyship 0.1.6__py3-none-any.whl → 0.1.7__py3-none-any.whl

pyship/_version_.py

@@ -2,7 +2,7 @@ from pyshipupdate import __author__ as pyship_author
 
 __application_name__ = "pyship"
 __author__ = pyship_author
-__version__ = "0.1.6"
+__version__ = "0.1.7"
 __title__ = __application_name__
 __author_email__ = "j@abel.co"
 __url__ = "https://github.com/jamesabel/pyship"

pyship/create_launcher.py

@@ -4,6 +4,7 @@ import subprocess
 
 from typeguard import typechecked
 from balsa import get_logger
+from semver import VersionInfo
 
 from pyshipupdate import mkdirs
 import pyship
@@ -99,6 +100,7 @@ def create_pyship_launcher(target_app_info: AppInfo, app_path_output: Path):
             # avoid re-building launcher if its functionality wouldn't change
             assert isinstance(target_app_info.author, str)
             assert isinstance(target_app_info.is_gui, bool)
+            assert isinstance(target_app_info.version, VersionInfo)
             metadata = calculate_metadata(target_app_info.name, target_app_info.author, target_app_info.version, Path(launcher_module_dir), icon_path, target_app_info.is_gui)
             if not launcher_exe_path.exists() or metadata != load_metadata(app_path_output, metadata_filename):
                 pyship_print(f'building launcher ("{launcher_exe_path}")')

pyship/download.py

@@ -32,6 +32,22 @@ def file_download(url: str, destination_folder: Path, file_name: Path):
     return destination_path
 
 
+def is_within_directory(directory: Path, target: Path):
+    abs_directory = directory.absolute()
+    abs_target = target.absolute()
+    prefix = os.path.commonprefix([abs_directory, abs_target])
+    return prefix == str(abs_directory)
+
+
+def safe_extract(tar, path: Path = Path(".")):
+    # for CVE-2007-4559
+    for member in tar.getmembers():
+        member_path = Path(path, member.name)
+        if not is_within_directory(path, member_path):
+            raise Exception("Attempted Path Traversal in Tar File")
+    tar.extractall(path, None, numeric_owner=False)
+
+
 @typechecked
 def extract(source_folder: Path, source_file: Path, destination_folder: Path):
     mkdirs(destination_folder, remove_first=True)
@@ -43,9 +59,9 @@ def extract(source_folder: Path, source_file: Path, destination_folder: Path):
             zf.extractall(destination_folder)
     elif source_file.suffix == ".tgz":
         with tarfile.open(source) as tf:
-            tf.extractall(destination_folder)
+            safe_extract(tf, destination_folder)
     elif source_file.suffix == ".gz":
         with tarfile.open(source) as tf:
-            tf.extractall(destination_folder)
+            safe_extract(tf, destination_folder)
     else:
         raise Exception(f"Unsupported file type {source_file.suffix} ({source_file})")

pyship/launcher/launcher.py

@@ -6,6 +6,7 @@ import appdirs
 import re
 import logging
 import subprocess
+from typing import Union
 
 from ismain import is_main
 from balsa import HandlerType, get_logger
@@ -73,7 +74,7 @@ def setup_logging(is_gui: bool, report_exceptions: bool) -> bool:
     return verbose
 
 
-def launch(additional_path: Path = None, app_dir: Path = None) -> int:
+def launch(additional_path: Union[Path, None] = None, app_dir: Union[Path, None] = None) -> int:
     """
     launch the pyship app
     :param additional_path - additional search path for app (mainly for testing)
@@ -97,8 +98,8 @@ def launch(additional_path: Path = None, app_dir: Path = None) -> int:
     target_app_author = __author__
 
     for metadata_file_path in app_dir.glob("*_metadata.json"):
-        with metadata_file_path.open() as f:
-            metadata = json.load(f)
+        with metadata_file_path.open() as metadata_file:
+            metadata = json.load(metadata_file)
             target_app_name = metadata.get("app")
             target_app_author = metadata.get("author", target_app_author)
             is_gui = metadata.get("is_gui", is_gui)
@@ -187,7 +188,7 @@ def launch(additional_path: Path = None, app_dir: Path = None) -> int:
                                     log_function(out)
 
                         # log, and possibly print, each line of output from the process
-                        for name, std_x, f in [("stdout", std_out, sys.stdout), ("stderr", std_err, sys.stderr)]:
+                        for name, std_x, sys_f in [("stdout", std_out, sys.stdout), ("stderr", std_err, sys.stderr)]:
                             if std_x is not None and len(std_x.strip()) > 0:
                                 for so_line in std_x.splitlines():
                                     so_line_strip = so_line.strip()
@@ -195,7 +196,7 @@ def launch(additional_path: Path = None, app_dir: Path = None) -> int:
                                         log.info(f"{name}:{so_line_strip}")  # when logging, start with the name of the output string (stdout, stderr)
 
                                 # output stdout, stderr that came (directly) from the process
-                                print(std_x, file=f)
+                                print(std_x, file=sys_f)
 
                         log.info(f"{return_code=}")
 

pyship/pyship.py

@@ -7,6 +7,7 @@ from attr import attrs
 from typeguard import typechecked
 from awsimple import S3Access
 from balsa import get_logger
+from semver import VersionInfo
 
 from pyship import __application_name__ as pyship_application_name
 from pyship import __author__ as pyship_author
@@ -32,7 +33,7 @@ class PyShip:
     cloud_id: Union[str, None] = None  # e.g. AWS Access Key ID
     cloud_secret: Union[str, None] = None  # e.g. AWS Secret Access Key
     cloud_access: Union[PyShipCloud, None] = None  # making this accessible outside this class aids in testing, especially when mocking
-    upload: bool = True  # set to False to tell pyship to not attempt to perform file upload to the cloud (e.g. installer, clip files to AWS S3)
+    upload: bool = True  # set to False in order to tell pyship to not attempt to perform file upload to the cloud (e.g. installer, clip files to AWS S3)
 
     @typechecked
     def ship(self) -> Path:
@@ -63,6 +64,7 @@ class PyShip:
             clip_dir = create_clip(target_app_info, app_dir, True, Path(self.project_dir, self.dist_dir), self.cache_dir, self.find_links)
 
             clip_file_path = create_clip_file(clip_dir)  # create clip file
+            assert isinstance(target_app_info.version, VersionInfo)
             installer_exe_path = run_nsis(target_app_info, target_app_info.version, app_dir)  # create installer
 
             if self.upload:

{pyship-0.1.6.dist-info → pyship-0.1.7.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pyship
-Version: 0.1.6
+Version: 0.1.7
 Summary: freezer, installer and updater for Python applications
 Home-page: https://github.com/jamesabel/pyship
 Download-URL: https://github.com/jamesabel/pyship

{pyship-0.1.6.dist-info → pyship-0.1.7.dist-info}/RECORD

@@ -1,21 +1,21 @@
 pyship/__init__.py,sha256=x7jisL_D4Wuyw5tfmyLz57WlRLX9QQYpkb3Vne_J3W0,1336
 pyship/__main__.py,sha256=mn9BUEsE52gyI7SLrXh_dBxLwD335iVG_iqRCNqocq4,86
-pyship/_version_.py,sha256=s-tyBvcMBAL-DIOAUGlD0JGMe-peqnUrSIg7hxunfSY,389
+pyship/_version_.py,sha256=_lpeahvzNw7RLUbyDSBVoziS-tN4LJxasGcrBlkALBo,389
 pyship/app_info.py,sha256=mhbwJHkoWek1FRv9dwRlrf_8ssNK-UtDhvnZ-8kWQFo,7347
 pyship/arguments.py,sha256=p4cA8FwbNSZqg4XI6LsYit1QN7TpAWWZH2xrgLf-f-g,1882
 pyship/atomic_zip.py,sha256=HEZuHEatyWAGqZcvS_EoByQQRCQph5ajkszfZ3OxnRU,1366
 pyship/clip.py,sha256=kmdbnzJbgD9ggBEUqs73_p2kac2looaOeGItk9N50xo,8237
 pyship/cloud.py,sha256=FDJvTlURrtA00z3a8fWkR_K7YzURNKnd0NypJQKxHAo,1264
 pyship/constants.py,sha256=FVkr1c9XDkaXyQnL1bEP-dWSbk4SUkrRuVQYPIxHMaA,19
-pyship/create_launcher.py,sha256=vIZi5ABVmfXKFc9IHjYMkyAVbRKkSIxWgvHSdIyNrD8,6146
-pyship/download.py,sha256=inG18XKZ1qhOam27prKT0cTUx1IXRQooUPiIezZ_xf8,1871
+pyship/create_launcher.py,sha256=HQby4dmnBnSbohspex8TaCgu-jEaEjLb1QGE76D_ky4,6247
+pyship/download.py,sha256=QHbdVwxLNBToMEC0tOF2ZquDpoydRu0-cj7LOERr5Q4,2460
 pyship/get-pip.py,sha256=BC5otuX7znr6F8Llv4oQLwLDp22R0GwHmThf0UIHRHI,1829954
 pyship/logging.py,sha256=cIB7487tN8TsKeDHwwzjA30rHRW5Ci5GA5uPbaEXaY0,966
 pyship/main.py,sha256=pALpy8ooWsKkUpWUtGWO567I9u1fbIFWdBU0dnWm2K4,866
 pyship/nsis.py,sha256=QhG8FMwFZRsoPQbntCSCr5av1NNqgjksinhfxXpc0Vg,12744
 pyship/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pyship/pyship.ico,sha256=9oiMtmA7NiBmxM0NmMJQU5jXmnbEWCdqTaO3XvJ7ozY,103500
-pyship/pyship.py,sha256=tqTd6kOU7i_LP9VCfSCcGZBpGU8OfPiCxb7arRAIGuc,5444
+pyship/pyship.py,sha256=vMeFK940mIReKTMy0x-hFvTHXfATt97tL5knyK7R_9I,5554
 pyship/pyship_custom_print.py,sha256=WHgZNZNiKwQjKmxdsBrn7aJfG5VJdfQ1-9AC_tg5MxE,651
 pyship/pyship_exceptions.py,sha256=teUOh3FuRUU9hyv7L4owACQZPWNdwpYTEz6l-Ao35nw,959
 pyship/pyship_get_icon.py,sha256=FwglA67RXX0lhW9baIGsQy3_T4hVsVkBmvAhPyuhHLo,2016
@@ -24,13 +24,13 @@ pyship/pyship_subprocess.py,sha256=hH4MW_j2zLJLDmLDkkl2JWupXrvSemAeCPAEtPdSGyk,3
 pyship/launcher/__init__.py,sha256=25vVghziYIHDBA0mCaGqhj6hWxxjQqlm4LrY0Hem0YY,245
 pyship/launcher/__main__.py,sha256=KhFSf1RU5Cj15y0c4FlzvIvDpWWi9NKYy0gzJ-w7KQE,115
 pyship/launcher/hash.py,sha256=THEh8G-StEJeh5tH24RnAQpYB0Zv1nnBwqOoStN6_NY,1153
-pyship/launcher/launcher.py,sha256=XI0X4NvYYxz88dYf9_Fk7D1D_Y0qC1ZRfef1RFB4r5g,10275
+pyship/launcher/launcher.py,sha256=AmjAwt8VbQTOVmRC-vUd7Cm-KS3ALYe1RLSxmcutthY,10359
 pyship/launcher/metadata.py,sha256=vkf70w_eX8EZbMDHFKqBWW1kn0RyZl70z4DGsLCahmA,1666
 pyship/launcher/restart_monitor.py,sha256=jfzchLxGuC_xUNdPAr849FhAdozJ6BX9M-gqLd-gGIA,952
 pyship/patch/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pyship/patch/pyship_patch.py,sha256=KgObD80QPeOhu1KCdhdQzn-4AnyzCUxIGWKj22BjTCc,1256
-pyship-0.1.6.dist-info/LICENSE,sha256=wJpPh6rC_YhbTZ7ZIy1VjrqeLdJ8Pz0ppx2MUi7s8Dg,1088
-pyship-0.1.6.dist-info/METADATA,sha256=ZEZv2MqEiTzDYtbXX3_6u-xhynfaIFW3lP2wEFYLWw8,1361
-pyship-0.1.6.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
-pyship-0.1.6.dist-info/top_level.txt,sha256=mlozeft-UInVAceSajzNvtkn2vPa8El9j0RulsTVtlU,7
-pyship-0.1.6.dist-info/RECORD,,
+pyship-0.1.7.dist-info/LICENSE,sha256=wJpPh6rC_YhbTZ7ZIy1VjrqeLdJ8Pz0ppx2MUi7s8Dg,1088
+pyship-0.1.7.dist-info/METADATA,sha256=0vrDjPX1xcZbErIhF_WDmKFPVRgviw4a0iJhEPLUm00,1361
+pyship-0.1.7.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
+pyship-0.1.7.dist-info/top_level.txt,sha256=mlozeft-UInVAceSajzNvtkn2vPa8El9j0RulsTVtlU,7
+pyship-0.1.7.dist-info/RECORD,,