Skip to content

Instantly share code, notes, and snippets.

@mbijon

mbijon/mitigation.py

Forked from sethmlarson/mitigation.py
Created December 21, 2025 20:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mbijon/e171b6d76ed664ff9e2e38813aa8c61e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mbijon/e171b6d76ed664ff9e2e38813aa8c61e to your computer and use it in GitHub Desktop.
Download ZIP
Mitigation for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, and CVE-2024-12718
Raw
mitigation.py
import pathlib
# Avoid insecure segments in link names.
# 'tar' is a tarfile open for reading.
for member in tar.getmembers():
if member.linkname and '..' in pathlib.Path(member.linkname).parts:
raise OSError("Tarfile with insecure segment ('..') in linkname")
# Now safe to extract members with the data filter.
tar.extractall(filter="data")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment