Skip to content

Commit 4ec9fea

Browse files
committed
Don't guess component lengths when PC_PATH_MAX is available
1 parent f8f2786 commit 4ec9fea

File tree

1 file changed

+14
-10
lines changed

1 file changed

+14
-10
lines changed

Lib/test/test_tarfile.py

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3793,18 +3793,20 @@ def test_realpath_limit_attack(self):
37933793

37943794
with ArchiveMaker() as arc:
37953795
# populate the symlinks and dirs that expand in os.path.realpath()
3796-
# The number is chosen so that in common cases, the unexpanded
3796+
# The component length is chosen so that in common cases, the unexpanded
37973797
# path fits in PATH_MAX, but it overflows when the final symlink
37983798
# is expanded
3799-
if sys.platform == 'darwin':
3800-
component = 'd' * 55
3801-
elif sys.platform == 'win32':
3802-
component = 'd' * 25
3803-
elif sys.platform == 'android':
3799+
steps = "abcdefghijklmnop"
3800+
if sys.platform == 'win32':
38043801
component = 'd' * 25
3802+
elif 'PC_PATH_MAX' in os.pathconf_names:
3803+
max_path_len = os.pathconf(self.outerdir.parent, "PC_PATH_MAX")
3804+
path_sep_len = 1
3805+
dest_len = len(str(self.destdir)) + path_sep_len
3806+
component_len = (max_path_len - dest_len) // (len(steps) + path_sep_len)
3807+
component = 'd' * component_len
38053808
else:
3806-
component = 'd' * 247
3807-
steps = "abcdefghijklmnop"
3809+
raise NotImplementedError("Need to guess component length for {sys.platform}")
38083810
path = ""
38093811
step_path = ""
38103812
for i in steps:
@@ -3836,7 +3838,9 @@ def test_realpath_limit_attack(self):
38363838
if sys.platform == 'win32':
38373839
self.expect_exception((FileNotFoundError, FileExistsError))
38383840
elif self.raised_exception:
3839-
# Most likely, guess for number of components was wrong?
3841+
# This block should never enter. This is left for debugging why
3842+
# there was an unexpected exception.
3843+
# Most likely, the guess for number of components was wrong?
38403844
try:
38413845
raise self.raised_exception
38423846
except KeyError:
@@ -3851,7 +3855,7 @@ def test_realpath_limit_attack(self):
38513855
self.expect_file('a', symlink_to=component)
38523856

38533857
for filter in 'tar', 'data':
3854-
with self.subTest(filter), self.check_context(arc.open(), filter='tar'):
3858+
with self.subTest(filter), self.check_context(arc.open(), filter=filter):
38553859
if os_helper.can_hardlink():
38563860
exc = self.expect_exception(OSError)
38573861
if sys.platform == 'win32':

0 commit comments

Comments
 (0)