termux-sync 1.2.2__tar.gz → 1.2.4__tar.gz

{termux_sync-1.2.2 → termux_sync-1.2.4}/CHANGELOG.md

@@ -9,6 +9,18 @@ Version numbers follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+---
+
+## [1.2.4] - 2026-07-28
+
+### Security
+
+- **`restore` — arbitrary file write via attacker-controlled `source` field in `manifest.json` (High, GHSA-259w-wmqg-fp76)** — during restore, `manifest["files"][key]["source"]` was taken from the backup archive itself (fully attacker-controlled) and used directly as the extraction destination, and `extract_archive()` called `tarfile.extract()` on every member with no path-containment check. A malicious or tampered backup could therefore write/overwrite arbitrary files anywhere the Termux user has write access, including shell startup files. Fixed by: (1) deriving the extraction destination only from the app's own known `BACKUP_ITEMS` roots instead of manifest content, refusing unknown manifest keys; (2) validating every tar member's resolved path (and symlink/hardlink targets) stays inside the destination before extraction, and rejecting device/fifo entries; (3) using Python's built-in `filter="data"` extraction filter on 3.12+; (4) sanitizing `backup_name` before it's used to build the temp restore path. Reported privately by [Niranj R Mahaswar](https://github.com/NiranjMahaswar).
+
+### Fixed
+
+- **`delete` (GitHub storage) — `Failed to delete backup from GitHub: Expecting value: line 1 column 1 (char 0)`** — `GitHubStorage._api()` unconditionally called `json.loads()` on every API response, but GitHub's REST API returns `204 No Content` with an empty body for `DELETE /releases/{id}` and `DELETE /git/refs/tags/{tag}`, so the empty body failed JSON parsing and the delete was reported as failed (even when it actually succeeded on GitHub's side). `_api()` now returns `{}` for empty/204 responses instead of trying to parse them as JSON.
+
 ### Planned
 
 - Archive encryption using a user-provided password
@@ -18,6 +30,14 @@ Version numbers follow [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.2.3] - 2026-07-11
+
+### Fixed
+
+- Bump version in `termux-sync.py` and `__init__.py` for pip installer
+
+---
+
 ## [1.2.2] - 2026-07-11
 
 ### Fixed

{termux_sync-1.2.2 → termux_sync-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: termux-sync
-Version: 1.2.2
+Version: 1.2.4
 Summary: Backup and restore your entire Termux environment across devices
 Project-URL: Homepage, https://github.com/djunekz/termux-sync
 Project-URL: Repository, https://github.com/djunekz/termux-sync

{termux_sync-1.2.2 → termux_sync-1.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "termux-sync"
-version = "1.2.2"
+version = "1.2.4"
 description = "Backup and restore your entire Termux environment across devices"
 readme = "README.md"
 license = { file = "LICENSE" }

{termux_sync-1.2.2 → termux_sync-1.2.4}/src/termux_sync/__init__.py

@@ -43,7 +43,7 @@ try:
 except ImportError:
     RICH_AVAILABLE = False
 
-VERSION       = "1.2.1"
+VERSION       = "1.2.4"
 APP_NAME      = "termux-sync"
 CONFIG_DIR    = Path.home() / ".config" / APP_NAME
 CONFIG_FILE   = CONFIG_DIR / "config.json"
@@ -277,18 +277,62 @@ def create_archive(
     return out
 
 
+def _safe_extract_member(member: tarfile.TarInfo, dest_path: Path):
+    dest_root = dest_path.resolve()
+
+    member_name = member.name
+    if member_name.startswith("/") or member_name.startswith("\\"):
+        raise ValueError(f"Unsafe absolute path in archive: {member_name!r}")
+    if any(part == ".." for part in Path(member_name).parts):
+        raise ValueError(f"Path traversal attempt in archive: {member_name!r}")
+
+    target = (dest_path / member_name).resolve()
+    try:
+        target.relative_to(dest_root)
+    except ValueError:
+        raise ValueError(f"Archive member escapes destination: {member_name!r} -> {target}")
+
+    if member.issym() or member.islnk():
+        link_target = member.linkname
+        if os.path.isabs(link_target):
+            raise ValueError(f"Unsafe absolute link target in archive: {member_name!r} -> {link_target!r}")
+        resolved_link = (target.parent / link_target).resolve()
+        try:
+            resolved_link.relative_to(dest_root)
+        except ValueError:
+            raise ValueError(f"Archive link escapes destination: {member_name!r} -> {link_target!r}")
+
+    if member.ischr() or member.isblk() or member.isfifo():
+        raise ValueError(f"Refusing device/fifo entry in archive: {member_name!r}")
+
+
 def extract_archive(archive_path: Path, dest_path: Path, label: str, progress: Progress):
     task = progress.add_task(f"[cyan]{label}", total=None)
     dest_path.mkdir(parents=True, exist_ok=True)
+
+    has_data_filter = hasattr(tarfile, "data_filter")
+
     with tarfile.open(archive_path, "r:*") as tf:
         for member in tf.getmembers():
             try:
-                tf.extract(member, dest_path, set_attrs=True)
+                _safe_extract_member(member, dest_path)
+            except ValueError as e:
+                log("WARNING", f"Skipped unsafe archive member during restore: {e}")
+                continue
+
+            try:
+                if has_data_filter:
+                    tf.extract(member, dest_path, set_attrs=True, filter="data")
+                else:
+                    tf.extract(member, dest_path, set_attrs=True)
             except Exception:
                 try:
                     member.uid = os.getuid()
                     member.gid = os.getgid()
-                    tf.extract(member, dest_path, set_attrs=False)
+                    if has_data_filter:
+                        tf.extract(member, dest_path, set_attrs=False, filter="data")
+                    else:
+                        tf.extract(member, dest_path, set_attrs=False)
                 except Exception:
                     pass
     progress.update(task, total=1, completed=1, description=f"[green]{label} ✓")
@@ -485,7 +529,12 @@ class GitHubStorage:
         req  = urllib.request.Request(url, data=data, headers=self._headers(), method=method)
         try:
             with urllib.request.urlopen(req) as resp:
-                return json.loads(resp.read())
+                if resp.status == 204:
+                    return {}
+                body = resp.read()
+                if not body:
+                    return {}
+                return json.loads(body)
         except urllib.error.HTTPError as e:
             body = e.read().decode()
             raise RuntimeError(f"GitHub API error {e.code}: {body}") from e
@@ -930,6 +979,12 @@ def cmd_restore(cfg: dict, backup_name: str = ""):
         except ValueError:
             backup_name = choice
 
+    safe_backup_name = os.path.basename(str(backup_name).replace("\\", "/")).strip()
+    if not safe_backup_name or safe_backup_name in (".", "..") or "/" in safe_backup_name:
+        console.print(f"  [red]✗ Invalid backup name: {backup_name!r}[/red]")
+        return
+    backup_name = safe_backup_name
+
     tmp_dir = Path(os.environ.get("TMPDIR", "/data/data/com.termux/files/usr/tmp")) / f"restore_{backup_name}"
     tmp_dir.mkdir(parents=True, exist_ok=True)
 
@@ -1003,9 +1058,26 @@ def cmd_restore(cfg: dict, backup_name: str = ""):
         TimeElapsedColumn(),
         console=console,
     ) as progress:
+        # Build the set of destinations this app is actually willing to restore into.
+        # Manifest-supplied "source" values are attacker-controlled backup content
+        # and must never be trusted as an extraction root — only used to double
+        # check they agree with the known-safe root for that item key.
+        allowed_roots = {}
+        for item_key, _label, item_root in BACKUP_ITEMS:
+            if item_root is not None:
+                allowed_roots[item_key] = Path(item_root).resolve().parent
+
         for key, info in manifest.get("files", {}).items():
             archive = tmp_dir / info["archive"]
-            src_dir = Path(info.get("source", str(TERMUX_FILES))).parent
+
+            src_dir = allowed_roots.get(key)
+            if src_dir is None:
+                # Unknown key not part of this app's known backup items — refuse
+                # to derive a destination from untrusted manifest content.
+                console.print(f"  [red]✗ Refusing unknown/untrusted restore target for {key!r}[/red]")
+                log("WARNING", f"Refused restore for unknown manifest key: {key!r}")
+                continue
+
             try:
                 extract_archive(archive, src_dir, info["archive"], progress)
                 log("INFO", f"Extracted {info['archive']} → {src_dir}")