fix: set filter="data" explicitly (#2278)

Author: jamesgetx

apiserver/paasng/paasng/platform/sourcectl/package/client.py

@@ -112,7 +112,9 @@ def read_file(self, file_path: str) -> bytes:
 
     def export(self, local_path: str):
         """导出指定当前 Tar 包到local_path"""
-        self.tar.extractall(local_path)
+        # set filter="data" explicitly to fix CVE-2007-4559
+        # see https://docs.python.org/3.11/library/tarfile.html#tarfile-extraction-filter
+        self.tar.extractall(local_path, filter="data")  # type: ignore[call-arg]
 
     def close(self):
         """关闭文件句柄"""
@@ -192,16 +194,12 @@ def list(self, tarfile_like: bool = True) -> List[str]:
     @staticmethod
     def _is_invalid_file_format_error(message: str) -> bool:
         """Check if the stderr message indicates an invalid file format."""
-        if re.search(r"tar:.* not look like a tar archive", message):
-            return True
-        return False
+        return bool(re.search(r"tar:.* not look like a tar archive", message))
 
     @staticmethod
     def _is_not_found_error(message: str) -> bool:
         """Check if the stderr message indicates a file not found."""
-        if re.search(r"tar:.*: Not found in archive", message):
-            return True
-        return False
+        return bool(re.search(r"tar:.*: Not found in archive", message))
 
 
 class ZipClient(BasePackageClient):

apiserver/paasng/tests/paasng/platform/smart_app/conftest.py

@@ -53,7 +53,9 @@ def zip_path(contents):
 @pytest.fixture()
 def untar_path(tar_path):
     with tarfile.open(tar_path) as tar, generate_temp_dir() as worker_dir:
-        tar.extractall(worker_dir)
+        # set filter="data" explicitly to fix CVE-2007-4559
+        # see https://docs.python.org/3.11/library/tarfile.html#tarfile-extraction-filter
+        tar.extractall(worker_dir, filter="data")  # type: ignore[call-arg]
         yield worker_dir