@@ -474,6 +474,15 @@ def _ensure_parent_dir(self, path: Path):
474
474
def _get_extraction_path (self , path : Path , path_use_description : str ) -> Path :
475
475
fs_path = self ._fs_path (path )
476
476
477
+ if fs_path .absolute_path .exists ():
478
+ report = ExtractionProblem (
479
+ path = str (fs_path .relative_path ),
480
+ problem = f"Attempting to create a file that already exists through { path_use_description } " ,
481
+ resolution = "Overwrite." ,
482
+ )
483
+ fs_path .absolute_path .unlink ()
484
+ self .record_problem (report )
485
+
477
486
if not fs_path .is_safe :
478
487
report = PathTraversalProblem (
479
488
path = str (fs_path .relative_path ),
@@ -540,11 +549,16 @@ def mknod(self, path: Path, mode=0o600, device=0):
540
549
541
550
def _get_checked_link (self , src : Path , dst : Path ) -> Optional [_FSLink ]:
542
551
link = _FSLink (root = self .root , src = src , dst = dst )
543
- if link .is_safe :
544
- return link
545
552
546
- self .record_problem (link .format_report ("Potential path traversal through link" ))
547
- return None
553
+ if link .src .absolute_path .exists ():
554
+ self .record_problem (link .format_report ("File already exists." ))
555
+ return None
556
+ if not link .is_safe :
557
+ self .record_problem (
558
+ link .format_report ("Potential path traversal through link" )
559
+ )
560
+ return None
561
+ return link
548
562
549
563
def _path_to_root (self , from_dir : Path ) -> Path :
550
564
# This version does not look at the existing symlinks, so while it looks cleaner it is also
0 commit comments