Skip to content

Commit 0227a0d

Browse files
fix _decompress security problem (#61294) (#61337)
1 parent aeaa0ca commit 0227a0d

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

python/paddle/utils/download.py

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,10 @@ def _decompress(fname):
311311

312312
def _uncompress_file_zip(filepath):
313313
with zipfile.ZipFile(filepath, 'r') as files:
314-
file_list = files.namelist()
314+
file_list_tmp = files.namelist()
315+
file_list = []
316+
for file in file_list_tmp:
317+
file_list.append(file.replace("../", ""))
315318

316319
file_dir = os.path.dirname(filepath)
317320

@@ -340,7 +343,10 @@ def _uncompress_file_zip(filepath):
340343

341344
def _uncompress_file_tar(filepath, mode="r:*"):
342345
with tarfile.open(filepath, mode) as files:
343-
file_list = files.getnames()
346+
file_list_tmp = files.getnames()
347+
file_list = []
348+
for file in file_list_tmp:
349+
file_list.append(file.replace("../", ""))
344350

345351
file_dir = os.path.dirname(filepath)
346352

0 commit comments

Comments
 (0)