mirror of
https://github.com/home-assistant/supervisor.git
synced 2026-02-15 07:27:13 +00:00
523a267524
Replace filter="fully_trusted" with a custom backup_data_filter that wraps tarfile.data_filter. This adds protection against symlink attacks (absolute targets, destination escapes), device node injection, and path traversal, while resetting uid/gid and sanitizing permissions. Unlike using data_filter directly, the custom filter skips problematic entries with a warning instead of aborting the entire extraction. This ensures existing backups containing absolute symlinks (e.g. in shared folders) still restore successfully with the dangerous entries omitted. Also removes the now-redundant secure_path member filtering, as data_filter is a strict superset of its protections. Fixes a standalone bug in _folder_restore which had no member filtering at all. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
33 lines
894 B
Python
33 lines
894 B
Python
"""Util add-on functions."""
|
|
|
|
import hashlib
|
|
import logging
|
|
import re
|
|
import tarfile
|
|
|
|
_LOGGER: logging.Logger = logging.getLogger(__name__)
|
|
|
|
RE_DIGITS = re.compile(r"\d+")
|
|
|
|
|
|
def create_slug(name: str, date_str: str) -> str:
|
|
"""Generate a hash from repository."""
|
|
key = f"{date_str} - {name}".lower().encode()
|
|
return hashlib.sha1(key).hexdigest()[:8]
|
|
|
|
|
|
def backup_data_filter(
|
|
member: tarfile.TarInfo, dest_path: str
|
|
) -> tarfile.TarInfo | None:
|
|
"""Filter for backup tar extraction.
|
|
|
|
Applies tarfile.data_filter for security (rejects dangerous symlinks,
|
|
device nodes, resets uid/gid) but skips problematic entries with a
|
|
warning instead of aborting the entire extraction.
|
|
"""
|
|
try:
|
|
return tarfile.data_filter(member, dest_path)
|
|
except tarfile.FilterError as err:
|
|
_LOGGER.warning("Skipping %s: %s", member.name, err)
|
|
return None
|