Zip Slip Vulnerability on Torchx Examples

[aydinnyunus]

🐛 Bug

Zip Slip is a widespread arbitrary file overwrite critical vulnerability, which typically results in remote command execution

https://github.com/pytorch/torchx/blob/main/torchx/examples/apps/lightning/data.py#L147

Module (check all that applies):

• [ ] torchx.spec
• [ ] torchx.component
• [ ] torchx.apps
• [ ] torchx.runtime
• [ ] torchx.cli
• [ ] torchx.schedulers
• [ ] torchx.pipelines
• [ ] torchx.aws
• [x] torchx.examples
• [ ] other

To Reproduce

Steps to reproduce the behavior:

I created simple PoC

import tarfile

tar_path = "zip-slip.tar"
data_path = "output"
print(f"extracting {tar_path} to {data_path}...")
with tarfile.open(tar_path, mode="r") as f:
    f.extractall(data_path)

Expected behavior

If file contains malicious extract path it should be sanitized or gives error

latest torchx