Skip to content

Commit

Permalink
Bugfix: for absolute links in tarfile extraction
Browse files Browse the repository at this point in the history
Explicitly use extract_root in output path instead of ./ to avoid
issues with symlinks within directories.
  • Loading branch information
Andrew Fasano committed Feb 12, 2024
1 parent 76c29fe commit fc60755
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion unblob/handlers/archive/_safe_tarfile.py
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ def extract(self, tarinfo: tarfile.TarInfo, extract_root: Path): # noqa: C901
"Absolute path as link target.",
"Converted to extraction relative path.",
)
tarinfo.linkname = f"./{tarinfo.linkname}"
tarinfo.linkname = f"{extract_root}/{tarinfo.linkname}"

if not is_safe_path(
basedir=extract_root,
Expand Down

0 comments on commit fc60755

Please sign in to comment.