Patching CVE-2007-4559

Author: TrellixVulnTeam

TMessagesProj/jni/boringssl/util/bot/go/bootstrap.py

@@ -132,7 +132,26 @@ def install_toolset(toolset_root, url):
       f.extractall(toolset_root)
   elif pkg_path.endswith('.tar.gz'):
     with tarfile.open(pkg_path, 'r:gz') as f:
-      f.extractall(toolset_root)
+      def is_within_directory(directory, target):
+          
+          abs_directory = os.path.abspath(directory)
+          abs_target = os.path.abspath(target)
+      
+          prefix = os.path.commonprefix([abs_directory, abs_target])
+          
+          return prefix == abs_directory
+      
+      def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+      
+          for member in tar.getmembers():
+              member_path = os.path.join(path, member.name)
+              if not is_within_directory(path, member_path):
+                  raise Exception("Attempted Path Traversal in Tar File")
+      
+          tar.extractall(path, members, numeric_owner=numeric_owner) 
+          
+      
+      safe_extract(f, toolset_root)
   else:
     raise Failure('Unrecognized archive format')