# HG changeset patch
# User iuc
# Date 1681633852 0
# Node ID 14785f8a372547f5b1f5131ad632c5d0b09dc4f1
# Parent  19d9be08560c0344dcc9d4bdeafe82f7e57c4376
planemo upload for repository https://github.com/galaxyproject/tools-iuc/tree/master/data_managers/data_manager_mitos commit 096286097ed5cdf189a1b68c3fc34d10f4142e54

diff -r 19d9be08560c -r 14785f8a3725 data_manager/data_manager.py
--- a/data_manager/data_manager.py	Sun Nov 22 18:03:14 2020 +0000
+++ b/data_manager/data_manager.py	Sun Apr 16 08:30:52 2023 +0000
@@ -54,7 +54,21 @@
             src.close()
     with tarfile.open(tarfname, "r:bz2") as tar:
         dirname = tar.getnames()[0]
-        tar.extractall(workdir)
+
+        def is_within_directory(directory, target):
+            abs_directory = os.path.abspath(directory)
+            abs_target = os.path.abspath(target)
+            prefix = os.path.commonprefix([abs_directory, abs_target])
+            return prefix == abs_directory
+
+        def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+            for member in tar.getmembers():
+                member_path = os.path.join(path, member.name)
+                if not is_within_directory(path, member_path):
+                    raise Exception("Attempted Path Traversal in Tar File")
+            tar.extractall(path, members, numeric_owner=numeric_owner)
+
+        safe_extract(tar, workdir)
     os.remove(tarfname)
     return dirname
 
diff -r 19d9be08560c -r 14785f8a3725 data_manager_conf.xml
--- a/data_manager_conf.xml	Sun Nov 22 18:03:14 2020 +0000
+++ b/data_manager_conf.xml	Sun Apr 16 08:30:52 2023 +0000
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <data_managers>
-    <data_manager tool_file="data_manager/data_manager_mitos.xml" id="mitos_fetcher" version="0.0.1">
+    <data_manager tool_file="data_manager/data_manager_mitos.xml" id="mitos_fetcher">
         <data_table name="mitos">
             <output>
                 <column name="value" />