Webble: Fix symlink leaks in ZIP downloads with enhanced path validation

Vulnerability Fix Summary Overview Type: Security Fix Title: Commit: Commit , authored by , committed on June 24 Related: PR #20238, branch → Nature: There is a risk of symlink leaks during ZIP downloads. An attacker can craft a malicious ZIP package containing symlinks that point to other paths on the system, potentially causing information leakage or unauthorized access. Scope of Impact Affected Modules: , , , , , Affected Features: ZIP downloads, file path resolution, symlink handling, path normalization (e.g., , , ) Affected Versions: Versions between and Remediation 1. Enhanced Path Validation: New/modified functions in such as , , and enforce strict validation of downloaded file paths to prevent symlinks from escaping the expected directory. 2. Hardened ZIP Download Logic: New test cases in verify that symlinks in ZIP downloads do not point to external paths like . 3. Metadata and Path Exclusions: In , constants such as and are used to exclude specific paths, preventing symlinks from pointing to metadata directories. 4. Test Coverage: New tests and in cover symlink behavior in ZIP upload/download scenarios. POC / Exploit Code The provided screenshot does not include a standalone POC code block, but the following test code illustrates the vulnerability trigger and verification logic: ```python webble/trans/test_views.py class ZipUploadTest(TestCase): def test_zip_download_validates_symlink_file(self): sentinel = 'outside-resolver' with TemporaryDirectory() as root_name, TemporaryDirectory() as outside_name: outside = Path(outside_name) (root / 'git' / 'config').write_bytes(b'repository metadata') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'transl

Goal Reached Thanks to every supporter — we hit 100%!

Webble: Fix symlink leaks in ZIP downloads with enhanced path validation

More from this source