Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

filter data is safe for tarfile extractall #1111

Merged
merged 3 commits into from
Feb 27, 2024
Merged

filter data is safe for tarfile extractall #1111

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
349a344
filter data is safe for tarfile extractall
etienneschalk Feb 27, 2024
921a87d
Merge branch 'main' into eschalk/issue-1038-tarfile_unsafe_members
etienneschalk Feb 27, 2024
0dfa7ca
add versionchanged to the docstring
etienneschalk Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions bandit/plugins/tarfile_unsafe_members.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,13 @@ def get_members_value(context):
return {"Other": value}


def is_filter_data(context):
for keyword in context.node.keywords:
if keyword.arg == "filter":
arg = keyword.value
return isinstance(arg, ast.Str) and arg.s == "data"


@test.test_id("B202")
@test.checks("Call")
def tarfile_unsafe_members(context):
Expand All @@ -100,6 +107,8 @@ def tarfile_unsafe_members(context):
"extractall" in context.call_function_name,
]
):
if "filter" in context.call_keywords and is_filter_data(context):
return None
if "members" in context.call_keywords:
members = get_members_value(context)
if "Function" in members:
Expand Down
14 changes: 14 additions & 0 deletions examples/tarfile_extractall.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,18 @@ def managed_members_archive_handler(filename):
tar.close()


def filter_data_archive_handler(filename):
tar = tarfile.open(filename)
tar.extractall(path=tempfile.mkdtemp(), filter="data")
tar.close()


def filter_fully_trusted_archive_handler(filename):
tar = tarfile.open(filename)
tar.extractall(path=tempfile.mkdtemp(), filter="fully_trusted")
tar.close()


def list_members_archive_handler(filename):
tar = tarfile.open(filename)
tar.extractall(path=tempfile.mkdtemp(), members=[])
Expand Down Expand Up @@ -45,3 +57,5 @@ def members_filter(tarfile):
filename = sys.argv[1]
unsafe_archive_handler(filename)
managed_members_archive_handler(filename)
filter_data_archive_handler(filename)
filter_fully_trusted_archive_handler(filename)
4 changes: 2 additions & 2 deletions tests/functional/test_functional.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -926,7 +926,7 @@ def test_snmp_security_check(self):
def test_tarfile_unsafe_members(self):
"""Test insecure usage of tarfile."""
expect = {
"SEVERITY": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 1},
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 1},
"SEVERITY": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 2},
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 2},
}
self.check_example("tarfile_extractall.py", expect)