Prevent local directory traversal when GCS has a name starting with /
.
PiperOrigin-RevId: 313396192 Change-Id: If18872476818bc9b2ad2340b22b4275140fbb000
This commit is contained in:
parent
b1a712d40d
commit
b97bfb5d69
@ -736,6 +736,15 @@ def walk_v2(top, topdown=True, onerror=None):
|
||||
`(dirname, [subdirname, subdirname, ...], [filename, filename, ...])`.
|
||||
Each item is a string.
|
||||
"""
|
||||
|
||||
def _make_full_path(parent, item):
|
||||
# Since `os.path.join` discards paths before one that starts with the path
|
||||
# separator (https://docs.python.org/3/library/os.path.html#os.path.join),
|
||||
# we have to manually handle that case as `/` is a valid character on GCS.
|
||||
if item[0] == os.sep:
|
||||
return "".join([os.path.join(parent, ""), item])
|
||||
return os.path.join(parent, item)
|
||||
|
||||
top = compat.as_str_any(top)
|
||||
try:
|
||||
listing = list_directory(top)
|
||||
@ -748,7 +757,7 @@ def walk_v2(top, topdown=True, onerror=None):
|
||||
files = []
|
||||
subdirs = []
|
||||
for item in listing:
|
||||
full_path = os.path.join(top, item)
|
||||
full_path = _make_full_path(top, item)
|
||||
if is_directory(full_path):
|
||||
subdirs.append(item)
|
||||
else:
|
||||
@ -760,7 +769,8 @@ def walk_v2(top, topdown=True, onerror=None):
|
||||
yield here
|
||||
|
||||
for subdir in subdirs:
|
||||
for subitem in walk_v2(os.path.join(top, subdir), topdown, onerror=onerror):
|
||||
for subitem in walk_v2(
|
||||
_make_full_path(top, subdir), topdown, onerror=onerror):
|
||||
yield subitem
|
||||
|
||||
if not topdown:
|
||||
|
Loading…
x
Reference in New Issue
Block a user