unzip-http 0.7__tar.gz → 0.8__tar.gz

{unzip_http-0.7/unzip_http.egg-info → unzip_http-0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.7
+Version: 0.8
 Summary: extract files from .zip files over http without downloading entire archive
 Author: Saul Pwanson
 Project-URL: Homepage, https://github.com/saulpw/unzip-http

{unzip_http-0.7 → unzip_http-0.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "unzip-http"
-version = "0.7"
+version = "0.8"
 description = "extract files from .zip files over http without downloading entire archive"
 readme = "README.md"
 requires-python = ">=3.10"

unzip_http-0.8/tests/test_unzip_http.py

@@ -0,0 +1,37 @@
+import io
+import pathlib
+from types import SimpleNamespace
+
+import pytest
+
+import unzip_http
+
+
+def fake_rzf(contents):
+    rzf = unzip_http.RemoteZipFile.__new__(unzip_http.RemoteZipFile)
+    rzf.open = lambda fn: io.BytesIO(contents)
+    return rzf
+
+
+@pytest.mark.parametrize('member', ['../escaped.txt', '/tmp/absolute.txt', 'sub/../../escaped.txt'])
+def test_extract_refuses_escaping_member(tmp_path, member):
+    target = tmp_path/'target'
+    target.mkdir()
+    with pytest.raises(Exception, match='unsafe path'):
+        fake_rzf(b'x').extract(member, path=target)
+    assert list(tmp_path.rglob('*')) == [target]
+
+
+def test_extract_writes_inside_target(tmp_path):
+    fake_rzf(b'hello').extract('sub/ok.txt', path=tmp_path)
+    assert (tmp_path/'sub'/'ok.txt').read_bytes() == b'hello'
+
+
+def test_cli_full_filepaths_refuses_escaping_member(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(unzip_http, 'extract_one', lambda outfile, rzf, f, ofname: outfile.write(b'x'))
+    f = SimpleNamespace(filename='../escaped.txt', compress_size=1)
+    args = SimpleNamespace(files=['*'], stdout=False, full_filepaths=True)
+    with pytest.raises(Exception, match='unsafe path'):
+        unzip_http.download_file(f, None, args)
+    assert not (tmp_path.parent/'escaped.txt').exists()

{unzip_http-0.7 → unzip_http-0.8/unzip_http.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.7
+Version: 0.8
 Summary: extract files from .zip files over http without downloading entire archive
 Author: Saul Pwanson
 Project-URL: Homepage, https://github.com/saulpw/unzip-http

{unzip_http-0.7 → unzip_http-0.8}/unzip_http.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 unzip_http.py
+tests/test_unzip_http.py
 unzip_http.egg-info/PKG-INFO
 unzip_http.egg-info/SOURCES.txt
 unzip_http.egg-info/dependency_links.txt

{unzip_http-0.7 → unzip_http-0.8}/unzip_http.py

@@ -56,7 +56,7 @@ import pathlib
 import urllib.parse
 
 
-__version__ = '0.6'
+__version__ = '0.8'
 
 
 def error(s):
@@ -117,6 +117,14 @@ class RemoteZipInfo:
             i += fieldsz
 
 
+def safe_extract_path(base, member):
+    base = pathlib.Path(base).resolve()
+    target = (base / member).resolve()
+    if base != target and base not in target.parents:
+        raise Exception(f'refusing unsafe path in zip member: {member!r}')
+    return target
+
+
 class RemoteZipFile:
     fmt_eocd = '<IHHHHIIH'  # end of central directory
     fmt_eocd64 = '<IQHHIIQQQQ'  # end of central directory ZIP64
@@ -223,10 +231,10 @@ class RemoteZipFile:
 
             path = path or pathlib.Path('.')
 
-            outpath = path/member
+            outpath = safe_extract_path(path, member)
             os.makedirs(outpath.parent, exist_ok=True)
             with self.open(member) as fpin:
-                with open(path/member, mode='wb') as fpout:
+                with open(outpath, mode='wb') as fpout:
                     while True:
                         r = fpin.read(65536)
                         if not r:
@@ -354,6 +362,7 @@ def download_file(f, rzf, args):
     else:
         path = pathlib.Path(f.filename)
         if args.full_filepaths:
+            path = safe_extract_path('.', path)
             path.parent.mkdir(parents=True, exist_ok=True)
         else:
             path = path.name