PyThaiNLP / pythainlp / 21372060598

54%

dev: 54%

Build Type

Pull #1225

github

Committed by Copilot

Commit Message

Fix symlink vulnerabilities in archive extraction

- Add symlink target validation for tar and zip extraction
- Use tarfile.data_filter for Python 3.12+ with fallback for 3.9-3.11
- Validate both file paths and symlink targets to prevent escape
- Improve _is_within_directory to properly handle path separators
- Add comprehensive tests for symlink attacks
- Update security documentation with symlink attack scenarios

Co-authored-by: bact <128572+bact@users.noreply.github.com>

Pull Request Pull Request #1225: Security: Fix path traversal and symlink attacks in archive extraction

Run Details

18 of 47 new or added lines in 2 files covered. (38.3%)

1 existing line in 1 file now uncovered.

4574 of 8537 relevant lines covered (53.58%)

0.54 hits per line