This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit ea0aa7f0bd2bc140d3c36922e281514c36984f82 Author: Dave Brondsema <[email protected]> AuthorDate: Thu May 21 18:12:33 2026 -0400 [#8607] svn tarball path safety --- ForgeSVN/forgesvn/model/svn.py | 3 ++- ForgeSVN/forgesvn/tests/model/test_repository.py | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ForgeSVN/forgesvn/model/svn.py b/ForgeSVN/forgesvn/model/svn.py index b58d6daaf..6fd5d7dd1 100644 --- a/ForgeSVN/forgesvn/model/svn.py +++ b/ForgeSVN/forgesvn/model/svn.py @@ -681,7 +681,8 @@ def get_changes(self, oid): def _tarball_path_clean(self, path, rev=None): if path: - return path.strip('/') + parts = [p for p in path.strip('/').split('/') if p and p != '..'] + return '/'.join(parts) else: trunk_exists = svn_path_exists('file://{}{}/{}'.format(self._repo.fs_path, self._repo.name, 'trunk'), rev) if trunk_exists: diff --git a/ForgeSVN/forgesvn/tests/model/test_repository.py b/ForgeSVN/forgesvn/tests/model/test_repository.py index cf3fdfddc..9254a9ef7 100644 --- a/ForgeSVN/forgesvn/tests/model/test_repository.py +++ b/ForgeSVN/forgesvn/tests/model/test_repository.py @@ -492,6 +492,14 @@ def test_tarball_paths(self): ignore_errors=True) shutil.rmtree(tarball_path, ignore_errors=True) + def test_tarball_path_clean_strips_traversal(self): + clean = self.repo._impl._tarball_path_clean + assert clean('trunk/../../other-repo') == 'trunk/other-repo' + assert clean('/../etc/passwd/') == 'etc/passwd' + assert clean('..') == '' + assert clean('trunk//sub') == 'trunk/sub' + assert clean('trunk/sub') == 'trunk/sub' + def test_is_empty(self): assert not self.repo.is_empty() with TempDirectory() as d:
