Multiple Arbitrary File Write vulnerabilities about unitypackage_extractor HOT 3 CLOSED

Thank you for the link to tarsafe, I will give that a look.

For the second vulnerability, you think it would just be enough to skip w/ notify versus abort? I like the idea of it at least being able to continue if one pathname is malformed/absolute, for whatever reason

Thank you for the submit

from unitypackage_extractor.

At the end of the day, I don't think it really matters whether it'll skip or abort. I just have a personal preference for abort here (of course notifying the user why it aborted) and not extracting anything, because I don't see any reason why Unity (or external stuff, which seems rarely used) would generate them. If for some reason there'd be a lot of .unitypackage files out there that had invalid entries in them (e.g. if, say, Unity 1.0 stored some metadata files under absolute paths or something) I'd choose skipping, but since this is entirely unexpected (and a potential security issue) I'm going for aborting.

from unitypackage_extractor.

Aight, should be fixed, added 2 tests for the pathname writing outside the extract path as well as using tarsafe now.

Let me know if #15 looks good

from unitypackage_extractor.