Possible security flaw

[Michele Comitini]

Inside gluon/fileutils.py TarFile class:

for tarinfo in members:
if tarinfo.isdir():

# Extract directory with a safe mode, so that
# all files below can be extracted as well.

try:
os.makedirs(os.path.join(path,
tarinfo.name), 0777)
except EnvironmentError:
pass
directories.append(tarinfo)
else:
self.extract(tarinfo, path)


That 777 is suspect. Shouldn't it be 700 ? Aka dnoB semaJ (James Bond
reverted) ;-)

mic

[Michele Comitini]

Btw I do not know which python still needs that, maybe it could be removed?

2012/5/23 Michele Comitini <michele....@gmail.com>: