Skip to content

Commit c8d5f77

Browse files
filter data is safe for tarfile extractall (#1111)
* filter data is safe for tarfile extractall * add versionchanged to the docstring
1 parent e041e12 commit c8d5f77

File tree

3 files changed

+28
-2
lines changed

3 files changed

+28
-2
lines changed

bandit/plugins/tarfile_unsafe_members.py

+12
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242
4343
.. versionadded:: 1.7.5
4444
45+
.. versionchanged:: 1.7.8
46+
Added check for filter parameter
47+
4548
"""
4649
import ast
4750

@@ -91,6 +94,13 @@ def get_members_value(context):
9194
return {"Other": value}
9295

9396

97+
def is_filter_data(context):
98+
for keyword in context.node.keywords:
99+
if keyword.arg == "filter":
100+
arg = keyword.value
101+
return isinstance(arg, ast.Str) and arg.s == "data"
102+
103+
94104
@test.test_id("B202")
95105
@test.checks("Call")
96106
def tarfile_unsafe_members(context):
@@ -100,6 +110,8 @@ def tarfile_unsafe_members(context):
100110
"extractall" in context.call_function_name,
101111
]
102112
):
113+
if "filter" in context.call_keywords and is_filter_data(context):
114+
return None
103115
if "members" in context.call_keywords:
104116
members = get_members_value(context)
105117
if "Function" in members:

examples/tarfile_extractall.py

+14
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,18 @@ def managed_members_archive_handler(filename):
1515
tar.close()
1616

1717

18+
def filter_data_archive_handler(filename):
19+
tar = tarfile.open(filename)
20+
tar.extractall(path=tempfile.mkdtemp(), filter="data")
21+
tar.close()
22+
23+
24+
def filter_fully_trusted_archive_handler(filename):
25+
tar = tarfile.open(filename)
26+
tar.extractall(path=tempfile.mkdtemp(), filter="fully_trusted")
27+
tar.close()
28+
29+
1830
def list_members_archive_handler(filename):
1931
tar = tarfile.open(filename)
2032
tar.extractall(path=tempfile.mkdtemp(), members=[])
@@ -45,3 +57,5 @@ def members_filter(tarfile):
4557
filename = sys.argv[1]
4658
unsafe_archive_handler(filename)
4759
managed_members_archive_handler(filename)
60+
filter_data_archive_handler(filename)
61+
filter_fully_trusted_archive_handler(filename)

tests/functional/test_functional.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -926,7 +926,7 @@ def test_snmp_security_check(self):
926926
def test_tarfile_unsafe_members(self):
927927
"""Test insecure usage of tarfile."""
928928
expect = {
929-
"SEVERITY": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 1},
930-
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 1},
929+
"SEVERITY": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 2},
930+
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 2},
931931
}
932932
self.check_example("tarfile_extractall.py", expect)

0 commit comments

Comments
 (0)