mirror of
https://git.freebsd.org/ports.git
synced 2025-04-30 18:46:38 -04:00
a4b2dd4648
This adds hardening measures while untaring archives fetched over the network (including FreeBSD tarballs and iocage plugins), as implemented by TrueNAS. This reduces the impact of intentionally malicious or accidentally broken archives. Please note that users are still advised to only fetch from trusted sources and make use of TLS to prevent MITM attacks. While there, add patch to store man pages in the correct location. Obtained from: https://github.com/truenas/iocage/pull/358
22 lines
815 B
Python
22 lines
815 B
Python
--- iocage_lib/ioc_plugin.py.orig 2024-09-20 06:45:27 UTC
|
|
+++ iocage_lib/ioc_plugin.py
|
|
@@ -61,7 +61,10 @@ from iocage_lib.dataset import Dataset
|
|
GIT_LOCK = threading.Lock()
|
|
RE_PLUGIN_VERSION = re.compile(r'"path":"([/\.\+,\d\w-]*)\.txz"')
|
|
|
|
+# deliberately crash if tarfile doesn't have required filter
|
|
+tarfile.tar_filter
|
|
|
|
+
|
|
class IOCPlugin(object):
|
|
|
|
"""
|
|
@@ -157,7 +160,7 @@ class IOCPlugin(object):
|
|
shutil.copyfileobj(r.raw, f)
|
|
|
|
with tarfile.open(packagesite_txz_path) as p_file:
|
|
- p_file.extractall(path=tmpdir)
|
|
+ p_file.extractall(path=tmpdir, filter='data')
|
|
|
|
packagesite_path = os.path.join(tmpdir, 'packagesite.yaml')
|
|
if not os.path.exists(packagesite_path):
|