Adding tarfile member sanitization to extractall()

resolwe_runtime_utils.py

@@ -726,7 +726,26 @@ def import7z():
 
                 if extracted_name.endswith('.tar'):
                     with tarfile.open(extracted_name) as tar:
-                        tar.extractall()
+                        def is_within_directory(directory, target):
+
+                            abs_directory = os.path.abspath(directory)
+                            abs_target = os.path.abspath(target)
+
+                            prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                            return prefix == abs_directory
+
+                        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                            for member in tar.getmembers():
+                                member_path = os.path.join(path, member.name)
+                                if not is_within_directory(path, member_path):
+                                    raise Exception("Attempted Path Traversal in Tar File")
+
+                            tar.extractall(path, members, numeric_owner) 
+
+
+                        safe_extract(tar)
 
                     os.remove(extracted_name)
                     destination_name, _ = os.path.splitext(extracted_name)