Restrict remote archive extraction to safe members

2026-10-27 19:49:51 +00:00 · 2026-10-27 19:49:51 +00:00 · c02815b0c1
commit c02815b0c1
parent df83ebc834
1 changed files with 34 additions and 1 deletions
--- a/great_ai/large_file/large_file/large_file_base.py
+++ b/great_ai/large_file/large_file/large_file_base.py
@ -197,7 +197,9 @@ class LargeFileBase(ABC):
                )

                logger.info(f"Decompressing {self._local_name}")
-                shutil.unpack_archive(str(tmp_file_archive), tmp, COMPRESSION_ALGORITHM)
+                shutil.unpack_archive(
+                    str(tmp_file_archive), tmp, COMPRESSION_ALGORITHM, filter="data"
+                )
                shutil.move(str(local_root_path / self._local_name), str(destination))
        else:
            logger.info(f"File {self._local_name} found in cache")