validate exceptions being thrown from invalid tarfile.open() params
authorPhilipp Gesang <philipp.gesang@intra2net.com>
Fri, 5 May 2017 08:20:50 +0000 (10:20 +0200)
committerThomas Jarosch <thomas.jarosch@intra2net.com>
Mon, 2 Apr 2018 11:34:08 +0000 (13:34 +0200)
deltatar/tarfile.py
testing/test_deltatar.py

index 50b395f..bdb40b1 100644 (file)
@@ -2123,7 +2123,8 @@ class TarFile(object):
             filemode = filemode or "r"
 
             if filemode not in "rw":
-                raise ValueError("mode must be 'r' or 'w'")
+                raise ValueError ("mode %s not compatible with concat "
+                                  "archive; must be 'r' or 'w'" % mode)
 
             stream = _Stream(name, filemode, comptype, fileobj, bufsize,
                              concat=True, encryption=encryption,
index a8dd8cc..557de07 100644 (file)
@@ -1536,11 +1536,22 @@ class DeltaTarTest(BaseTest):
             a.addfile(l)
             return name
 
-        with tarfile.open(tar_path,mode="a") as a:
-            checkme = \
-                [ add_symlink(a, "symlinks/foo", "internal-file")
-                , add_symlink(a, "symlinks/bar", "/absolute/path")
-                , add_symlink(a, "symlinks/baz", "../parent/../../paths") ]
+        try:
+            with tarfile.open(tar_path,mode="a") as a:
+                checkme = \
+                    [ add_symlink(a, "symlinks/foo", "internal-file")
+                    , add_symlink(a, "symlinks/bar", "/absolute/path")
+                    , add_symlink(a, "symlinks/baz", "../parent/../../paths") ]
+        except tarfile.ReadError as e:
+            if self.MODE == '#' or self.MODE.endswith ("gz"):
+                checkme = []
+            else:
+                raise
+        except ValueError as e:
+            if self.MODE.startswith ('#'):
+                checkme = []
+            else:
+                raise
 
         deltatar.restore_backup(target_path="source_dir",
                                 backup_tar_path=tar_path)
@@ -1556,7 +1567,6 @@ class DeltaTarTest(BaseTest):
         This simulates a symlink attack with a link pointing to some external
         path that is abused to write outside the extraction prefix.
         '''
-
         password, paramversion = self.ENCRYPTION or (None, None)
         deltatar = DeltaTar(mode=self.MODE, password=password,
                             crypto_paramversion=paramversion,
@@ -1588,11 +1598,22 @@ class DeltaTarTest(BaseTest):
         testpath = "symlinks/pernicious-link"
         testdst = "/tmp/does/not/exist"
 
-        with tarfile.open(tar_path,mode="w") as a:
-            add_symlink(a, testpath, testdst)
-            add_symlink(a, testpath, testdst+"X")
-            add_symlink(a, testpath, testdst+"XXX")
-            add_file(a, testpath)
+        try:
+            with tarfile.open(tar_path, mode="a") as a:
+                add_symlink(a, testpath, testdst)
+                add_symlink(a, testpath, testdst+"X")
+                add_symlink(a, testpath, testdst+"XXX")
+                add_file(a, testpath)
+        except tarfile.ReadError as e:
+            if self.MODE == '#' or self.MODE.endswith ("gz"):
+                pass
+            else:
+                raise
+        except ValueError as e:
+            if self.MODE.startswith ('#'):
+                pass # O_APPEND of concat archives not feasible
+            else:
+                raise
 
         deltatar.restore_backup(target_path="source_dir",
                                 backup_tar_path=tar_path)