Comments (3)
Thank you for the link to tarsafe, I will give that a look.
For the second vulnerability, you think it would just be enough to skip w/ notify versus abort? I like the idea of it at least being able to continue if one pathname is malformed/absolute, for whatever reason
Thank you for the submit
from unitypackage_extractor.
At the end of the day, I don't think it really matters whether it'll skip or abort. I just have a personal preference for abort here (of course notifying the user why it aborted) and not extracting anything, because I don't see any reason why Unity (or external stuff, which seems rarely used) would generate them. If for some reason there'd be a lot of .unitypackage files out there that had invalid entries in them (e.g. if, say, Unity 1.0 stored some metadata files under absolute paths or something) I'd choose skipping, but since this is entirely unexpected (and a potential security issue) I'm going for aborting.
from unitypackage_extractor.
Aight, should be fixed, added 2 tests for the pathname writing outside the extract path as well as using tarsafe now.
Let me know if #15 looks good
from unitypackage_extractor.
Related Issues (18)
- Newline stripping of pathname needs fixing HOT 2
- Deploy new version (build .exe's) HOT 3
- test_packageExtractWithUnicodePath fails on Windows HOT 2
- Extraction will fail if file inside package contains reserved character in Windows HOT 2
- How can I compress the files back into unitypackage? HOT 2
- EXE will not work HOT 3
- Hangs on large files HOT 6
- Does not start extraction process and hangs after drag-dropping a file HOT 3
- weird flags on virustotal HOT 3
- Easy way to extract whole folder of unitypackages
- Dunno about another thing related unity ? HOT 2
- [Feature Request] Progression bar
- File could not be opened successfully HOT 1
- Does not work with attached package HOT 2
- Extraction not working on package HOT 3
- 32bit? HOT 3
- Fails with UnicodeDecodeError on Japanese text in path HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from unitypackage_extractor.