Skip to content

Fix arbitrary file write vulnerability in _wget_download function - #61362

Closed
m0kr4n3 wants to merge 1 commit into
PaddlePaddle:developfrom
m0kr4n3:security/fix_arbitary_filewrite
Closed

m0kr4n3 wants to merge 1 commit into
PaddlePaddle:developfrom
m0kr4n3:security/fix_arbitary_filewrite

Conversation

@m0kr4n3

@m0kr4n3 m0kr4n3 commented Jan 30, 2024

Copy link
Copy Markdown

PR types

Bug fixes

PR changes

Others

Description

Add 2 checks:

  • checks if the fullname is empty.
  • ensures it's not a path.

@CLAassistant

CLAassistant commented Jan 30, 2024 •

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

1 similar comment
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@paddle-bot paddle-bot Bot added the contributor External developers label Jan 30, 2024

@VigiZhang VigiZhang left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@VigiZhang VigiZhang left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We prefer to remove this function from the utils package. 61356

@luotao1 luotao1 closed this Feb 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

contributor External developers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants