mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-15 15:37:03 +00:00
Code Issues Projects Releases Wiki Activity

bitbake: fetch2: validate deb/ipk data member names

Browse Source 
The deb/ipk unpack path selects a data archive member from 'ar -t'
output and then passes that member name to a shell command. Previously,
any member beginning with data.tar. was selected.

Only select known deb/ipk data archive member names when datafile is
created. Quote the package path used in the shell command as it can come
from the local fetch path.

Add local fetcher regression coverage for quoted package filenames,
valid compressed data members, and unsupported or unsafe data member
names.

(Bitbake rev: a32064d0f10b9f5a163a25f410a4e39dccf9cb93)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 73ae3a2447ec93df39bc66cf3d8f9b2ea1bfe3bf)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Anders Heimer
2026-05-18 16:59:08 +02:00
committed by Paul Barker
parent d4576e3c08
commit a42a436300
2 changed files with 60 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitbake/lib/bb/fetch2/__init__.py
+7 -3
View File
@@ -23,6 +23,7 @@ import collections
import subprocess
import pickle
import errno
import shlex
import bb.persist_data, bb.utils
import bb.checksum
import bb.process
@@ -1567,16 +1568,19 @@ class FetchMethod(object):
elif file.endswith('.deb') or file.endswith('.ipk'):
output = subprocess.check_output(['ar', '-t', file], preexec_fn=subprocess_setup)
datafile = None
valid_datafiles = ('data.tar', 'data.tar.gz', 'data.tar.xz',
'data.tar.zst', 'data.tar.bz2', 'data.tar.lzma')
if output:
for line in output.decode().splitlines():
if line.startswith('data.tar.'):
if line in valid_datafiles:
datafile = line
break
else:
raise UnpackError("Unable to unpack deb/ipk package - does not contain data.tar.* file", urldata.url)
raise UnpackError("Unable to unpack deb/ipk package - does not contain supported data.tar* file", urldata.url)
else:
raise UnpackError("Unable to unpack deb/ipk package - could not list contents", urldata.url)
cmd = 'ar x %s %s && %s -p -f %s && rm %s' % (file, datafile, tar_cmd, datafile, datafile)
quoted_datafile = shlex.quote(datafile)
cmd = 'ar x %s %s && %s -p -f %s && rm %s' % (shlex.quote(file), quoted_datafile, tar_cmd, quoted_datafile, quoted_datafile)
# If 'subdir' param exists, create a dir and use it as destination for unpack cmd
if 'subdir' in urldata.parm: