Check handling of unsafe paths in `pymupdf embed-extract`.
()
| 7 | |
| 8 | |
| 9 | def test_4767(): |
| 10 | ''' |
| 11 | Check handling of unsafe paths in `pymupdf embed-extract`. |
| 12 | ''' |
| 13 | if os.environ.get('PYODIDE_ROOT'): |
| 14 | print('test_4767(): not running on Pyodide - cannot run child processes.') |
| 15 | return |
| 16 | |
| 17 | if (1 |
| 18 | and platform.system() == 'Windows' |
| 19 | and os.environ.get('GITHUB_ACTIONS') == 'true' |
| 20 | and os.environ.get('CIBUILDWHEEL') == '1' |
| 21 | ): |
| 22 | print(f'test_4767(): not running because known to fail on Github/Windows/Cibuildwheel.') |
| 23 | # Using -unsafe makes pymupdf return 0 but does not seem to create |
| 24 | # output file. |
| 25 | return |
| 26 | |
| 27 | with pymupdf.open() as document: |
| 28 | document.new_page() |
| 29 | document.embfile_add( |
| 30 | 'evil_entry', |
| 31 | b'poc:traversal test\n', |
| 32 | filename="../../test.txt", |
| 33 | ufilename="../../test.txt", |
| 34 | desc="poc", |
| 35 | ) |
| 36 | document.embfile_add( |
| 37 | 'evil_entry2', |
| 38 | b'poc:traversal test\n', |
| 39 | filename="test2.txt", |
| 40 | ufilename="test2.txt", |
| 41 | desc="poc", |
| 42 | ) |
| 43 | path = os.path.abspath(f'{__file__}/../../tests/test_4767.pdf') |
| 44 | document.save(path) |
| 45 | testdir = os.path.abspath(f'{__file__}/../../tests/test_4767_dir').replace('\\', '/') |
| 46 | shutil.rmtree(testdir, ignore_errors=1) |
| 47 | os.makedirs(f'{testdir}/one/two', exist_ok=1) |
| 48 | |
| 49 | def run(command, *, check=0, capture=1): |
| 50 | print(f'Running: {command}') |
| 51 | cp = subprocess.run( |
| 52 | command, shell=1, |
| 53 | text=1, |
| 54 | check=check, |
| 55 | stdout=subprocess.PIPE if capture else None, |
| 56 | stderr=subprocess.STDOUT if capture else None, |
| 57 | ) |
| 58 | print(cp.stdout) |
| 59 | return cp |
| 60 | |
| 61 | def get_paths(): |
| 62 | paths = list() |
| 63 | for dirpath, dirnames, filenames in os.walk(testdir): |
| 64 | for filename in filenames: |
| 65 | path = f'{dirpath}/{filename}'.replace('\\', '/') |
| 66 | paths.append(path) |