Am 29. August 2011 18:21 schrieb Agata Murawska <[email protected]>:
> + input_name = None
> + if not tarfile.is_tarfile(input_path):
> + raise errors.OpPrereqError("The provided %s file is not a proper tar"
> + " archive", OVA_EXT)
> + ova_content = tarfile.open(input_path)
> + for file_name in ova_content.getnames():
> + file_normname = os.path.normpath(file_name)
> + if (os.path.commonprefix(["../", file_normname]) or
> + os.path.commonprefix(["/", file_normname])):
I guess this does not do what you intend to do. IIRC if you use
utils.PathJoin(temp_dir, file_normname) you'll get an error if
file_normname somehow moves up on the directory hierarchy.
> + raise errors.OpPrereqError("File %s inside %s package has untrusted"
> + " path" % (file_name, OVA_EXT))
Michael
