regebro / pyroma

Rate your Python packages package friendliness
MIT License
211 stars 24 forks source link

Avoid tar directory traversal on sdist extract to fix CVE-2007-4559 #90

Closed CAM-Gerlach closed 1 year ago

CAM-Gerlach commented 1 year ago

This fixes the tar directory traversal issue with Python's stdlib tarfile module's extractall function, replacing #89 and adapted from what we did in spyder-ide/spyder-kernels#428 , but greatly simplifying the implementation using pathlib (and making a few other tweaks to confirm with pyroma's style and practices).

Closes #89

regebro commented 1 year ago

Great!