Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb

@@ -9,7 +9,7 @@
 import requests
 
 from mindsdb.utilities import log
-from mindsdb.api.http.utils import http_error
+from mindsdb.api.http.utils import http_error, safe_extract
 from mindsdb.api.http.namespaces.configs.files import ns_conf
 from mindsdb.utilities.config import Config
 from mindsdb.utilities.context import context as ctx
@@ -134,7 +134,7 @@ def on_file(file):
                     f.extractall(temp_dir_path)
             elif lp.endswith('.tar.gz'):
                 with tarfile.open(file_path) as f:
-                    f.extractall(temp_dir_path)
+                    safe_extract(f, temp_dir_path)
             os.remove(file_path)
             files = os.listdir(temp_dir_path)
             if len(files) != 1:

@@ -1,4 +1,5 @@
 import json
+import os
 
 from flask import Response
 
@@ -22,3 +23,17 @@ def http_error(status_code, title, detail=''):
             'Content-Type': 'application/problem+json'
         }
     )
+
+def __is_within_directory(directory, target):
+    abs_directory = os.path.abspath(directory)
+    abs_target = os.path.abspath(target)
+    prefix = os.path.commonprefix([abs_directory, abs_target])
+    return prefix == abs_directory
+
+def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+    for member in tar.getmembers():
+        member_path = os.path.join(path, member.name)
+        if not __is_within_directory(path, member_path):
+            raise Exception("Attempted Path Traversal in Tar File")
+    tar.extractall(path, members, numeric_owner) 
+