From fc60755c1608822c26934c2e28df5055eebed5e7 Mon Sep 17 00:00:00 2001 From: Andrew Fasano Date: Mon, 12 Feb 2024 18:25:03 -0500 Subject: [PATCH] Bugfix: for absolute links in tarfile extraction Explicitly use extract_root in output path instead of ./ to avoid issues with symlinks within directories. --- unblob/handlers/archive/_safe_tarfile.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/unblob/handlers/archive/_safe_tarfile.py b/unblob/handlers/archive/_safe_tarfile.py index 2ddc8af2b7..0d6e5ceac6 100644 --- a/unblob/handlers/archive/_safe_tarfile.py +++ b/unblob/handlers/archive/_safe_tarfile.py @@ -82,7 +82,7 @@ def extract(self, tarinfo: tarfile.TarInfo, extract_root: Path): # noqa: C901 "Absolute path as link target.", "Converted to extraction relative path.", ) - tarinfo.linkname = f"./{tarinfo.linkname}" + tarinfo.linkname = f"{extract_root}/{tarinfo.linkname}" if not is_safe_path( basedir=extract_root,