Bugfix: for absolute links in tarfile extraction

Andrew Fasano · qkaiser · commit dfdf3e30027f · 2024-02-13T10:32:21.000+01:00
Explicitly use extract_root in output path instead of ./ to avoid
issues with symlinks within directories.
diff --git a/unblob/handlers/archive/_safe_tarfile.py b/unblob/handlers/archive/_safe_tarfile.py
@@ -82,7 +82,7 @@ def extract(self, tarinfo: tarfile.TarInfo, extract_root: Path):  # noqa: C901
                     "Absolute path as link target.",
                     "Converted to extraction relative path.",
                 )
-                tarinfo.linkname = f"./{tarinfo.linkname}"
+                tarinfo.linkname = f"{extract_root}/{tarinfo.linkname}"
 
             if not is_safe_path(
                 basedir=extract_root,

Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ def extract(self, tarinfo: tarfile.TarInfo, extract_root: Path): # noqa: C901`
`82`	`82`	`"Absolute path as link target.",`
`83`	`83`	`"Converted to extraction relative path.",`
`84`	`84`	`)`
`85`		`- tarinfo.linkname = f"./{tarinfo.linkname}"`
	`85`	`+ tarinfo.linkname = f"{extract_root}/{tarinfo.linkname}"`
`86`	`86`
`87`	`87`	`if not is_safe_path(`
`88`	`88`	`basedir=extract_root,`