diff --git a/detectors/x86_detector.py b/detectors/x86_detector.py index bab0841..090ce05 100644 --- a/detectors/x86_detector.py +++ b/detectors/x86_detector.py @@ -34,7 +34,26 @@ def load_model(self, model_path=None, label_map=None): os.makedirs(base_dir, exist_ok=True) wget.download(base_url + model_file, base_dir) with tarfile.open(base_dir + model_file, "r") as tar: - tar.extractall(path=base_dir) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path=base_dir) model_dir = pathlib.Path(model_path) / "saved_model" model = tf.saved_model.load(str(model_dir))