11# SPDX-FileCopyrightText: OpenSSF project contributors
22# SPDX-License-Identifier: MIT
3- """ Compliant Code Example """
3+ # SPDX-FileCopyrightText: OpenSSF project contributors
4+ # SPDX-License-Identifier: MIT
5+ """Compliant Code Example"""
6+
47import zipfile
58from pathlib import Path
69
710MAXSIZE = 100 * 1024 * 1024 # limit is in bytes
8- MAXAMT = 5 # max amount of files, includes directories in the archive
11+ MAXAMT = 1000 # max amount of files, includes directories in the archive
912
1013
1114class ZipExtractException (Exception ):
1215 """Custom Exception"""
1316
1417
15- def path_validation (input_path , base_path , permit_subdirs = True ):
16- """Ensure to have only allowed path names"""
17- test_path = (Path (base_path ) / input_path ).resolve ()
18- if permit_subdirs :
19- if not Path (base_path ).resolve () in test_path .resolve ().parents :
20- raise ZipExtractException (f"Filename { test_path } { Path (base_path )} )
21- else :
22- if test_path .parent != Path (base_path ).resolve ():
23- raise ZipExtractException (f"Filename { test_path } { Path (base_path )} )
18+ def path_validation (filepath : Path , base_path : Path ):
19+ """Ensure to have only allowed path names
20+
21+ Args:
22+ filepath (Path): path to archive
23+ base_path (Path): path to folder for extracting archives
24+
25+ Raises:
26+ ZipExtractException: if a directory traversal is detected
27+ """
28+ input_path_resolved = (base_path / filepath ).resolve ()
29+ base_path_resolved = base_path .resolve ()
30+
31+ if not str (input_path_resolved ).startswith (str (base_path_resolved )):
32+ raise ZipExtractException (
33+ f"Filename { str (input_path_resolved )} { str (base_path )}
34+ )
35+
2436
37+ def extract_files (filepath : str , base_path : str , exist_ok : bool = True ):
38+ """Extract archive below base_path
2539
26- def extract_files (file , base_path ):
27- """Unpack zip file into base_path"""
28- with zipfile .ZipFile (file , mode = "r" ) as archive :
29- dirs = []
30- # Validation:
40+ Args:
41+ filepath (str): path to archive
42+ base_path (str): path to folder for extracting archives
43+ exist_ok (bool, optional): Overwrite existing. Defaults to True.
44+
45+ Raises:
46+ ZipExtractException: If there are to many files
47+ ZipExtractException: If there are to big files
48+ ZipExtractException: If a directory traversal is detected
49+ """
50+ # TODO: avoid CWE-209: Generation of Error Message Containing Sensitive Information
51+
52+ with zipfile .ZipFile (filepath , mode = "r" ) as archive :
53+ # limit number of files:
3154 if len (archive .infolist ()) > MAXAMT :
32- raise ZipExtractException (f"Metadata check: too many files, limit is { MAXAMT } )
33- for zm in archive .infolist ():
34- if zm .file_size > MAXSIZE :
35- raise ZipExtractException (f"Metadata check: { zm .filename } { MAXSIZE } )
36- path_validation (zm .filename , base_path )
37- with archive .open (zm .filename , mode = 'r' ) as mte :
38- read_data = mte .read (MAXSIZE + 1 )
39- if len (read_data ) > MAXSIZE :
40- raise ZipExtractException (f"File { zm .filename } { MAXSIZE } )
55+ raise ZipExtractException (
56+ f"Metadata check: too many files, limit is { MAXAMT }
57+ )
4158
42- if not Path (base_path ).resolve ().exists ():
43- Path (base_path ).resolve ().mkdir (exist_ok = True )
59+ # validate by iterating over meta data:
60+ for item in archive .infolist ():
61+ # limit file size using meta data:
62+ if item .file_size > MAXSIZE :
63+ raise ZipExtractException (
64+ f"Metadata check: { item .filename } { MAXSIZE }
65+ )
4466
45- for zm in archive .infolist ():
46- # Extraction - create directories
47- if zm .is_dir ():
48- dirs .append (Path (base_path ).resolve ().joinpath (zm .filename ))
67+ path_validation (Path (item .filename ), Path (base_path ))
4968
50- for directory in dirs :
51- Path .mkdir (directory )
69+ # create target folder
70+ Path (base_path ).mkdir (exist_ok = exist_ok )
71+
72+ # preparing for extraction, need to create directories first
73+ # as they may come in random order to the files
74+ for item in archive .infolist ():
75+ if item .is_dir ():
76+ xpath = Path (base_path ).joinpath (item .filename ).resolve ()
77+ xpath .mkdir (exist_ok = exist_ok )
78+
79+ # start of extracting files:
80+ for item in archive .infolist ():
81+ if item .is_dir ():
82+ continue
83+ # we got a file
84+ with archive .open (item .filename , mode = "r" ) as filehandle :
85+ read_data = filehandle .read (MAXSIZE + 1 )
86+ if len (read_data ) > MAXSIZE :
87+ # meta data was lying to us, actual size is bigger:
88+ raise ZipExtractException (
89+ f"Reality check, { item .filename } { MAXSIZE }
90+ )
91+ xpath = Path (base_path ).joinpath (filehandle .name ).resolve ()
92+ with open (xpath , mode = "wb" ) as filehandle :
93+ filehandle .write (read_data )
94+ print (f"extracted successfully below { base_path } )
5295
53- for zm in archive .infolist ():
54- with archive .open (zm .filename , mode = 'r' ) as mte :
55- xpath = Path (base_path ).joinpath (mte .name ).resolve ()
56- print (f"Writing file { xpath } )
57- # Skip if directory
58- if xpath not in dirs : # check if file is a directory
59- with open (xpath , mode = "wb" ) as filehandle :
60- filehandle .write (read_data )
6196
97+ #####################
98+ # Trying to exploit above code example
99+ #####################
62100
63- extract_files ("zip_attack_test.zip" , "ziptemp" )
101+ extract_files ("zip_attack_test.zip" , "ziptemp" )
0 commit comments