Merge branch 'master' of https://github.com/TrellixVulnTeam/kitty_864P

kittens/diff/main.py

@@ -630,7 +630,26 @@ def get_ssh_file(hostname: str, rpath: str) -> str:
         raise SystemExit(p.returncode)
     with tarfile.open(fileobj=io.BytesIO(raw), mode='r:') as tf:
         members = tf.getmembers()
-        tf.extractall(tdir)
+        def is_within_directory(directory, target):
+            
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+        
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            
+            return prefix == abs_directory
+        
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+        
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+        
+            tar.extractall(path, members, numeric_owner) 
+            
+        
+        safe_extract(tf, tdir)
         if len(members) == 1:
             for root, dirs, files in os.walk(tdir):
                 if files: