Limit an in-memory tar member name to a safe relative path

Tar member names use slash-separated archive paths, so this example treats the candidate as a PurePosixPath rather than resolving it against a real filesystem. safe_member_name rejects absolute paths, parent-directory components, backslashes, NUL bytes, and Windows drive-qualified spellings such as C:/escape.txt. For the accepted input, notes/fixture.txt, it returns a normalized POSIX spelling suitable for the member name.

The code then creates an archive in io.BytesIO, constructs a TarInfo object, and supplies another BytesIO object as the member’s content. Reopening the archive and using extractfile checks that the member name and bytes survived archive serialization. It never calls extract or extractall, so it does not write the member to disk. The rejected-input loop makes the policy concrete for traversal, absolute, backslash-containing, and drive-qualified examples.

This is a narrow name-validation rule, not a complete archive-security policy. It does not inspect symlink targets, member types, duplicate names, resource limits, or a later modification of the archive. Python’s tar documentation warns that archive extraction has dangerous features and recommends inspection and appropriate extraction filters for untrusted archives. pathlib was added in Python 3.4, making Python 3.4 the minimum for this example; tarfile itself is older. Read the tarfile security guidance, TarInfo reference, and pathlib documentation.

import io
import tarfile
from pathlib import PurePosixPath, PureWindowsPath


def safe_member_name(name):
    if "\x00" in name or "\\" in name:
        raise ValueError("name contains a disallowed character")
    posix_path = PurePosixPath(name)
    windows_path = PureWindowsPath(name)
    if (
        posix_path.is_absolute()
        or not posix_path.parts
        or ".." in posix_path.parts
        or windows_path.is_absolute()
        or windows_path.drive
    ):
        raise ValueError("name is not a safe relative path")
    return posix_path.as_posix()


payload = b"tar fixture\n"
member_name = safe_member_name("notes/fixture.txt")

for unsafe in ("../escape.txt", "/absolute.txt", "notes\\escape.txt", "C:/escape.txt"):
    try:
        safe_member_name(unsafe)
    except ValueError:
        pass
    else:
        raise AssertionError(unsafe)

archive = io.BytesIO()
with tarfile.open(fileobj=archive, mode="w") as tar:
    info = tarfile.TarInfo(member_name)
    info.size = len(payload)
    tar.addfile(info, io.BytesIO(payload))

archive.seek(0)
with tarfile.open(fileobj=archive, mode="r") as tar:
    member = tar.getmember(member_name)
    extracted = tar.extractfile(member)
    assert extracted is not None
    assert extracted.read() == payload
    assert member.name == member_name

print("member=" + member_name)
member=notes/fixture.txt

AI assistance disclosure: this article was drafted with AI assistance and should be reviewed in the context of its project.

Comments

Post a Comment

Popular posts from this blog

Compare Two Text Files in Python Without Modifying Them

Batu Lab Notes · Batu When comparing two versions of a configuration or notes file, “are they the same?” is only the first question. The bytes may be identical, the visible text may be equal despite different line endings, or the content may contain a real change. For small UTF-8 text files, Python’s standard library can show these distinctions without writing to either input. Quick answer For small, stable UTF-8 files, read bounded bytes, compare them first, then decode and produce a bounded unified diff. Decide explicitly whether newline differences matter. Keep both inputs read-only and review the diff for private data before sharing it. Set a limit before reading Loading an input of unknown size directly into memory is a poor default. This example checks both sizes with Path.stat() , then performs a bounded read and applies a 256 KiB limit per file. It rejects directories and other non-regular paths. If reading raises OSError , the result includes the exception ty...
Read more

Seven CSV Quality Checks to Run Before Importing Data

Batu Lab Notes · Batu A CSV file is not ready for import merely because it opens. The wrong delimiter can collapse an entire row into one column. An unexpected encoding can damage non-ASCII characters. A repeated identifier can overwrite an existing record in the destination. A short, read-only check makes these problems visible before data reaches a spreadsheet or application. Quick answer Before importing a CSV, set its encoding and delimiter, validate the exact header and every row width, distinguish empty IDs, duplicate IDs, and duplicate rows, and keep the check read-only. 1. Specify the encoding Python may open a text file with the platform’s default encoding, which can differ across machines. If the expected encoding is UTF-8, encoding="utf-8-sig" is a practical choice: it reads ordinary UTF-8 and skips an optional UTF-8 byte order mark at the start. If decoding fails, verify the source application’s export settings instead of silently trying unrelat...
Read more

Explain why SQLite transactions cannot make an HTTP call atomic

Direct answer A SQLite transaction can atomically commit database statements handled by that connection. It cannot include an HTTP service in the same commit protocol. The example commits an outbox row first, then simulates a network failure. The durable row remains pending , which is exactly the information a later delivery worker needs instead of pretending both actions succeeded or failed together. The edge case is failure after the database commit but before remote acknowledgement. Retrying then requires an idempotency design owned by the remote endpoint or a stable request key; it is not supplied by SQLite’s COMMIT . Conversely, sending the request before storing a durable intent can leave no local evidence when the process stops. This demonstration intentionally does not make an HTTP request, implement an outbox dispatcher, or prove delivery exactly once. It shows the boundary that must be designed around. Use transactions to protect the local state transition, and test remote...
Read more