Fix tarfile security issue

3liz · Aug 8, 2024 · 94998ad · 94998ad
1 parent 5fe6b6c
commit 94998ad
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 3 deletions.
diff --git a/.docker/docker-compose.yml b/.docker/docker-compose.yml
@@ -1,5 +1,3 @@
-version: '3.9'
-
 networks:
   qgis_plugin_network:
 

diff --git a/cadastre/cadastre_import.py b/cadastre/cadastre_import.py
@@ -1009,7 +1009,27 @@ def unzipFolderContent(self, path):
                 for z in tarFileListA:
                     with tarfile.open(z) as t:
                         try:
-                            t.extractall(os.path.join(self.edigeoPlainDir, 'tar_%s' % i))
+                            # See https://docs.python.org/3.10/library/tarfile.html#tarfile.TarFile.extractall
+                            # See https://peps.python.org/pep-0706/
+                            arguments = {
+                                'filter': 'data'
+                            }
+                            if (3, 8, 0) <= sys.version_info < (3, 8, 17) \
+                                    or (3, 9, 0) <= sys.version_info < (3, 9, 17) \
+                                    or (3, 10, 0) <= sys.version_info < (3, 10, 12):
+                                # noinspection PyTypeChecker
+                                QgsMessageLog.logMessage(
+                                        "Version de Python obsolète, veuillez monter votre version de QGIS afin "
+                                        "de passer à une version plus récente",
+                                        'cadastre',
+                                        Qgis.Warning
+                                    )
+                                arguments.pop('filter')
+
+                            t.extractall(
+                                os.path.join(self.edigeoPlainDir, 'tar_%s' % i),
+                                **arguments,
+                            )
                         except tarfile.ReadError:
                             # Issue GitHub #339
                             self.go = False