[Security] tarfile.extractall without member validation in src/crate/testing/layer.py

[sudabg]

Severity: HIGH (Bandit B202)
File: src/crate/testing/layer.py

Vulnerability

tarfile.extractall() without member validation allows path traversal (zip slip). A malicious archive can write files outside the target directory.

Fix

import os

SAFE_ID = __import__("re").compile(r"^[a-zA-Z0-9_.-]+$")

def _is_within_directory(directory, target):
    abs_directory = os.path.realpath(directory)
    abs_target = os.path.realpath(target)
    return abs_target.startswith(abs_directory + os.sep) or abs_target == abs_directory

def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
    for member in tar.getmembers():
        member_path = os.path.join(path, member.name)
        if not _is_within_directory(path, member_path):
            raise Exception(f"Path traversal in tar: {member.name}")
    tar.extractall(path, members, numeric_owner=numeric_owner)

References

• CWE-22: Path Traversal
• Bandit B202
• OWASP: Zip Slip

[amotl]

Thank you very much. Would you be able to submit a corresponding patch to the project?

[mfussenegger]

Seems a bit like a false positive to me.
Or rather - fixing this wouldn't reduce the attack surface because after unpacking the tarball the test-layer will run bin/crate from the tarball.

So if the tarball were untrusted, you would still execute the contents. The binary can then do whatever under the users privileges. It's required that the test layer is only used with trusted tarballs.

The proposed fix also looks very odd (__import__ ?). What we can do use make use of the filter argument of extractall.