diff --git a/src/imagery/i.landsat/i.landsat.import/i.landsat.import.py b/src/imagery/i.landsat/i.landsat.import/i.landsat.import.py index 12f56f2754..0756395495 100755 --- a/src/imagery/i.landsat/i.landsat.import/i.landsat.import.py +++ b/src/imagery/i.landsat/i.landsat.import/i.landsat.import.py @@ -129,7 +129,6 @@ def _untar(inputdir, untardir): - if not os.path.exists(inputdir): gs.fatal(_("Directory <{}> does not exist").format(inputdir)) if not os.path.isdir(inputdir): @@ -156,25 +155,23 @@ def _untar(inputdir, untardir): for scene in scenes_to_untar: with tarfile.open(name=scene, mode="r") as tar: + def is_within_directory(directory, target): - abs_directory = os.path.abspath(directory) abs_target = os.path.abspath(target) - + prefix = os.path.commonprefix([abs_directory, abs_target]) - + return prefix == abs_directory - + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): - for member in tar.getmembers(): member_path = os.path.join(path, member.name) if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - - tar.extractall(path, members, numeric_owner=numeric_owner) - - + + tar.extractall(path, members, numeric_owner=numeric_owner) + safe_extract(tar, untardir) untared_tifs = glob.glob(os.path.join(untardir, "*.TIF")) @@ -299,7 +296,6 @@ def print_products(filenames): def main(): - inputdir = options["input"] untardir = options["unzip_dir"]