unzip-http 0.7__tar.gz → 0.9__tar.gz

{unzip_http-0.7/unzip_http.egg-info → unzip_http-0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.7
+Version: 0.9
 Summary: extract files from .zip files over http without downloading entire archive
 Author: Saul Pwanson
 Project-URL: Homepage, https://github.com/saulpw/unzip-http

{unzip_http-0.7 → unzip_http-0.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "unzip-http"
-version = "0.7"
+version = "0.9"
 description = "extract files from .zip files over http without downloading entire archive"
 readme = "README.md"
 requires-python = ">=3.10"

unzip_http-0.9/tests/test_unzip_http.py

@@ -0,0 +1,37 @@
+import io
+import pathlib
+from types import SimpleNamespace
+
+import pytest
+
+import unzip_http
+
+
+def fake_rzf(contents):
+    rzf = unzip_http.RemoteZipFile.__new__(unzip_http.RemoteZipFile)
+    rzf.open = lambda fn: io.BytesIO(contents)
+    return rzf
+
+
+@pytest.mark.parametrize('member', ['../escaped.txt', '/tmp/absolute.txt', 'sub/../../escaped.txt'])
+def test_extract_refuses_escaping_member(tmp_path, member):
+    target = tmp_path/'target'
+    target.mkdir()
+    with pytest.raises(Exception, match='unsafe path'):
+        fake_rzf(b'x').extract(member, path=target)
+    assert list(tmp_path.rglob('*')) == [target]
+
+
+def test_extract_writes_inside_target(tmp_path):
+    fake_rzf(b'hello').extract('sub/ok.txt', path=tmp_path)
+    assert (tmp_path/'sub'/'ok.txt').read_bytes() == b'hello'
+
+
+def test_cli_full_filepaths_refuses_escaping_member(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(unzip_http, 'extract_one', lambda outfile, rzf, f, ofname: outfile.write(b'x'))
+    f = SimpleNamespace(filename='../escaped.txt', compress_size=1)
+    args = SimpleNamespace(files=['*'], stdout=False, full_filepaths=True)
+    with pytest.raises(Exception, match='unsafe path'):
+        unzip_http.download_file(f, None, args)
+    assert not (tmp_path.parent/'escaped.txt').exists()

{unzip_http-0.7 → unzip_http-0.9/unzip_http.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.7
+Version: 0.9
 Summary: extract files from .zip files over http without downloading entire archive
 Author: Saul Pwanson
 Project-URL: Homepage, https://github.com/saulpw/unzip-http

{unzip_http-0.7 → unzip_http-0.9}/unzip_http.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 unzip_http.py
+tests/test_unzip_http.py
 unzip_http.egg-info/PKG-INFO
 unzip_http.egg-info/SOURCES.txt
 unzip_http.egg-info/dependency_links.txt

{unzip_http-0.7 → unzip_http-0.9}/unzip_http.py

@@ -56,7 +56,7 @@ import pathlib
 import urllib.parse
 
 
-__version__ = '0.6'
+__version__ = '0.9'
 
 
 def error(s):
@@ -117,6 +117,14 @@ class RemoteZipInfo:
             i += fieldsz
 
 
+def safe_extract_path(base, member):
+    base = pathlib.Path(base).resolve()
+    target = (base / member).resolve()
+    if base != target and base not in target.parents:
+        raise Exception(f'refusing unsafe path in zip member: {member!r}')
+    return target
+
+
 class RemoteZipFile:
     fmt_eocd = '<IHHHHIIH'  # end of central directory
     fmt_eocd64 = '<IQHHIIQQQQ'  # end of central directory ZIP64
@@ -129,6 +137,11 @@ class RemoteZipFile:
         import urllib3
         self.url = url
         self.http = urllib3.PoolManager()
+        self.default_headers = {
+            'User-Agent': f'unzip-http/{__version__}',
+            'Accept': '*/*',
+            'Connection': 'keep-alive',
+        }
         self.zip_size = 0
 
     def __enter__(self):
@@ -150,7 +163,7 @@ class RemoteZipFile:
         return list(r.filename for r in self.infoiter())
 
     def infoiter(self):
-        resp = self.http.request('HEAD', self.url)
+        resp = self._request('HEAD')
         if not (200 <= resp.status <= 299):
             error(f'cannot open URL: HTTP status {resp.status}')
 
@@ -223,10 +236,10 @@ class RemoteZipFile:
 
             path = path or pathlib.Path('.')
 
-            outpath = path/member
+            outpath = safe_extract_path(path, member)
             os.makedirs(outpath.parent, exist_ok=True)
             with self.open(member) as fpin:
-                with open(path/member, mode='wb') as fpout:
+                with open(outpath, mode='wb') as fpout:
                     while True:
                         r = fpin.read(65536)
                         if not r:
@@ -237,8 +250,14 @@ class RemoteZipFile:
         for fn in members or self.namelist():
             self.extract(fn, path, pwd=pwd)
 
+    def _request(self, method, headers=None, preload_content=True):
+        h = dict(self.default_headers)
+        if headers:
+            h.update(headers)
+        return self.http.request(method, self.url, headers=h, preload_content=preload_content)
+
     def get_range(self, start, n):
-        return self.http.request('GET', self.url, headers={'Range': f'bytes={start}-{start+n-1}'}, preload_content=False)
+        return self._request('GET', headers={'Range': f'bytes={start}-{start+n-1}'}, preload_content=False)
 
     def matching_files(self, *globs):
         for f in self.files.values():
@@ -354,6 +373,7 @@ def download_file(f, rzf, args):
     else:
         path = pathlib.Path(f.filename)
         if args.full_filepaths:
+            path = safe_extract_path('.', path)
             path.parent.mkdir(parents=True, exist_ok=True)
         else:
             path = path.name