\j<ddlZddlZddlZddlmZddlmZddlZddlm Z m Z m Z dede e efddfdZdd ed ed efd Zd ZGddZGddZy)N)Path)patch) ErrorMessage _unzip_iter_validate_member file_pathmembersreturnctj|d5}|jD]\}}|j|| dddy#1swYyxYw)zR Create a ZIP file at file_path, with the given arcname->content mapping. wN)zipfileZipFileitemswritestr)rr zfarcnamecontents N/root/env/lib/python3.12/site-packages/nltk/test/unit/test_downloader_unzip.py _make_zipr sQ C (*B '  * GW KK ) ****s +A  Azip_path extract_rootverbosecTttt|t||S)zj Convenience wrapper that runs _unzip_iter and returns the list of yielded messages (if any). r)listrstr)rrrs r_run_unzip_iterrs!  CM3|+z"_assert_blocked.."s91AII9s!z Expected z in error output: ) isinstancerjoin)messagesexpected_substringsr&err_msgscombinedss r_assert_blockedr/s$Caz!\'BCHC S;.BsEqz!\2Epkgzfile.txtsubdirz other.txtN)rrany read_bytes)selfr2rrr r*s r(test_normal_relative_paths_are_extractedz8TestSecureUnzip.test_normal_relative_paths_are_extracted2s j()+ %$,  (G$"8\5IEHEEEEu$z1==?8KKKu$x/+=IIKxWWWrc|dz }|dz }|dz dz j}ddd}t||t||d }t|d d |j rJ|d z d z j rJy)aD An entry containing ``..`` that would escape the target directory must not be written outside the extraction root, and must cause _unzip_iter to yield an ErrorMessage. The entire archive is rejected: even safe entries must NOT be extracted when any member fails validation. zzip_slip_parent.zipr4z..z outside.txtokevil) pkg/good.txtz../outside.txtFrZip Slipblockedr9good.txtN)resolverrr/exists)r=r2rroutside_targetr r*s r8test_zip_slip_with_parent_directory_component_is_blockedzHTestSecureUnzip.test_zip_slip_with_parent_directory_component_is_blockedGs33)+ &- =FFH"%  (G$"8\5I*i8!((***!5(:5==????rwin2Absolute POSIX paths are not meaningful on Windowsreasonc|dz }|dz }tddtjz } ddt|di}t ||t ||d }t |d d |jrJ|d z d z jrJ |jr |jyy#t$rYywxYw#|jr! |jw#t$rYwwxYwwxYw)a An entry with an absolute POSIX path (e.g. ``/tmp/evil``) must not be extracted as-is; it should not overwrite arbitrary filesystem paths, and should result in an ErrorMessage. The entire archive is rejected when any member fails validation. zzip_slip_abs_posix.zipr4/tmpnltk_zip_slip_test_rBr@rAFrrCrDr9rEN) rosgetpidrrrr/rGunlinkOSError)r=r2rrabsolute_targetr r*s r1test_zip_slip_with_absolute_posix_path_is_blockedzATestSecureUnzip.test_zip_slip_with_absolute_posix_path_is_blockedes66)+ v,+>ryy{m)LL O$gG h (&xuMH Hj) <&--/ //%u,z9AAC CCC%%'#**,(%%'#**,(sBA C!B33 B?>B?C5C%$C5% C1.C50C11C5cttdstjd|dz }|dz }|dz }|j |dz }ddd }t |||j  tj ||d z t||d }|jrJt|dd|dz dz jrJy#t$rtjd YfwxYw)a  If there is a pre-existing symlink below the extraction root that points outside the root, writing through that symlink should not be allowed to escape the root. The entire archive is rejected when any member fails validation. symlinkz'Symlinks not supported on this platformzzip_slip_symlink.zipr4 outside_dirzevil.txtr@rA)rBzdir_link/evil.txtdir_linkz/Symlink creation not permitted on this platformFrzSymlink escaperDr9rEN) hasattrrQpytestskipmkdirrrXrTrrGr/)r=r2rrrYrHr r*s r:test_entries_resolved_outside_root_are_blocked_via_symlinkzJTestSecureUnzip.test_entries_resolved_outside_root_are_blocked_via_symlinksr9% KKA B44)+ . $z1"!(  (G$ K JJ{L:$= >#8\5I!((***"2I>!5(:5==???? K KKI J Ks,C C,+C,c|dz }|jd|dz }t||d}td|DsJ|jrt|j rJyy)z A corrupt or non-zip file should cause _unzip_iter to yield an ErrorMessage instead of raising an unhandled exception. z not_a_zip.txtsthis is not a zip archiver4Frc3<K|]}t|tywr"r7r$s rr'zGTestSecureUnzip.test_bad_zipfile_yields_errormessage..sA1:a.Ar8N) write_bytesrr;rGiterdirr=r2rrr*s r$test_bad_zipfile_yields_errormessagez4TestSecureUnzip.test_bad_zipfile_yields_errormessagest o-9:)+ "8\5IAAAAA    <//12 222 !rcH|dz }|dz }t|dddddg}td| 5td 5}t||d }d d d d d d tddj |dz dz j rJy #1swYGxYw#1swYKxYw)a A member name containing a null byte must be rejected. Null bytes can cause path truncation on some platforms, so they are never legitimate in archive entry names. The entire archive is rejected when any member fails validation. Note: CPython's zipfile module truncates names at null bytes on read, so we patch ``namelist()`` to simulate a library that preserves them. z null_byte.zipr4r@rA)rBz pkg/evil.txtrB pkg/evil.txt(nltk.downloader.zipfile.ZipFile.namelist) return_value'nltk.downloader.zipfile.ZipFile.extractFrN Null byterDr9rE)rrrr/assert_not_calledrG)r=r2rrpoisoned_names mock_extractr*s r(test_null_byte_in_member_name_is_blockedz8TestSecureUnzip.test_null_byte_in_member_name_is_blockedso-)+ (UGLM(*<=  6'  N  5  N &xuMH  N N +y9&&( 5(:5==???? N N N Ns" BB B B BB!cD|dz }|dz }tddtjz } ddddt|d d d i}t ||t ||d }t |d}t|dk\sJd|jrJ|jrt|jrJ|jr |jyy#t$rYywxYw#|jr! |jw#t$rYwwxYwwxYw)a An archive that combines several different violation types (path traversal and absolute path) must report every violation and extract nothing. This verifies that the validation scan does not short-circuit after the first bad entry. zmulti_violation.zipr4rOnltk_multi_viol_test_z data/a.txtsaaaz../traversal.txtsevil1sevil2z data/b.txtsbbbFrrCz#Expected at least two ErrorMessagesN) rrQrRrrrr/lenrGr;rcrSrT)r=r2rrrUr r*r,s r@test_multiple_violation_types_all_reported_and_nothing_extractedzPTestSecureUnzip.test_multiple_violation_types_all_reported_and_nothing_extracteds:33)+ v,+@ )NN f"HO$hf G h (&xuMH&xDD DDDDc4|dz }|dz }|dz }t|ddi|j|jdtdt d 5t ||d }d d d t d |jdk(sJy #1swY+xYw)z{ If extraction fails mid-stream, pre-existing content under the extraction root must be preserved. zextract_error.zipr4zalready_there.txtr5dataskeep-merjzsimulated extraction failure side_effectFrNzExtraction error)rr^rbrrTrr/r<)r=r2rr existing_filer*s r>test_extraction_error_does_not_delete_preexisting_root_contentzNTestSecureUnzip.test_extraction_error_does_not_delete_preexisting_root_contents11)+ $':: (^W56!!*-  5 >?  N'xuMH  N "45'')Z777 N Ns BBc|dz }|dz }t|dditdtd5t||d }d d d t d|j rt |jrJy y #1swYBxYw) z If ``zf.namelist()`` itself raises (e.g. corrupted central directory), an ErrorMessage must be yielded and the zip file must be closed. znamelist_bomb.zipr4r5rvrhzcorrupted central directoryrwFrN)rr RuntimeErrorrr/rGr;rcrds r(test_namelist_raises_yields_errormessagez8TestSecureUnzip.test_namelist_raises_yields_errormessage's 11)+ (^W56  6$%BC  N'xuMH  N "?@    <//12 222 ! N Ns A??Bc|dz }|dz }ddi}t||t||d|j}d|jvsJy) z When verbose=True, _unzip_iter should write a status line to stdout. This checks that existing user-visible behaviour is preserved. z verbose.zipr4r5rvTr UnzippingN)rr readouterrout)r=capsysr2rrr captureds r(test_unzip_iter_verbose_writes_to_stdoutz8TestSecureUnzip.test_unzip_iter_verbose_writes_to_stdout<sX m+)+ !7+(G$,=$$&hll***rc|dz }|jd|dz }t||d|j}d|jvsJ|jj dsJy) z When verbose=True and the file is not a valid zip, the output line must still be terminated with a newline so the terminal is left in a clean state. z corrupt.txts not a zipr4Trr N)rbrrrendswith)r=rr2rrrs r"test_verbose_output_on_corrupt_zipz2TestSecureUnzip.test_verbose_output_on_corrupt_zipKsj m+\*)+ ,=$$&hll***||$$T***r)__name__ __module__ __qualname____doc__rr>rIr\markskipifsysplatform startswithrVr_rerortrzr}rrrrr1r1(sbXX$X*@@ @< [[ &C!$!SW! !F%@%@ %@N3T3d3 @@$@@ [[ &C%% % %N88 8233$3* + +RV + +4 +D +rr1c&eZdZdZdZdZdZdZejje jjddd Zejje jjd d d Zd Zd Zy)TestValidateMemberzADirect unit tests for ``_validate_member`` path validation logic.c<t|dz }td|Jy)Nrootr5rr)r=r2rs rtest_safe_relative_path_passesz1TestValidateMember.test_safe_relative_path_passes^s$8f$%5===rcHt|dz }td|}|d|vsJy)Nr ../evil.txtrCrr=r2rresults rtest_parent_traversal_blockedz0TestValidateMember.test_parent_traversal_blockedbs38f$%!-6!jF&:::&:rcHt|dz }td|}|d|vsJy)Nrza/b/c/../../../../evil.txtrCrrs r$test_deeply_nested_traversal_blockedz7TestValidateMember.test_deeply_nested_traversal_blockedgs48f$%!">E!jF&:::&:rcHt|dz }td|}|d|vsJy)Nrrgrkrrs rtest_null_byte_blockedz)TestValidateMember.test_null_byte_blockedls48f$%!"4d;!kV&;;;&;rrJrKrLcHt|dz }td|}|d|vsJy)Nrz /etc/passwdrCrrs r test_absolute_posix_path_blockedz3TestValidateMember.test_absolute_posix_path_blockedqs5 8f$%!-6!jF&:::&:rz1Drive-letter paths are only meaningful on WindowscHt|dz }td|}|d|vsJy)NrzC:\Windows\evil.txtrCrrs r!test_windows_drive_letter_blockedz4TestValidateMember.test_windows_drive_letter_blockedzs6 8f$%!"94@!jF&:::&:rct|dz }td|}tjj dr |d|vsJy|Jy)zOn Windows, backslash is a path separator so ``..\evil.txt`` is a traversal attack. On POSIX, backslash is a literal filename character and the member name is harmless.rz ..\evil.txtrJNrC)rrrrrrs rtest_backslash_traversalz+TestValidateMember.test_backslash_traversalsQ8f$%!.$7 << " "5 )%**> >>*>> !>rct|dz }tjjfd}t d|5t d|Jt d|}|d|vsJ dddy#1swYyxYw) zSimulate case-folding normcase (as on Windows) to verify that _validate_member applies it to both target and prefix paths.Rootc0|jSr")lower)poriginal_normcases rcase_folding_normcasez^TestValidateMember.test_normcase_is_applied_to_path_comparisons..case_folding_normcases$Q'--/ /rz nltk.downloader.os.path.normcaserwr5NrrC)rrQpathnormcaserr)r=r2rrrrs @r,test_normcase_is_applied_to_path_comparisonsz?TestValidateMember.test_normcase_is_applied_to_path_comparisonss8f$%GG,, 0 .-  ?$ND9A AA%mT:F%**> >>*> ? ? ?s #A))A2N)rrrrrrrrr\rrrrrrrrrrrrrr[sK>; ; <  [[ &C; ;  [[ LL # #E **B; ; "?rr)F)rQrr pathlibr unittest.mockrr\nltk.downloaderrrrdictrbytesrboolrr/r1rrrrrs|  GG**S%Z(8*T*PdP$PPp+p+f C?C?r