Webble: Fix symlink leaks in ZIP downloads with enhanced path validation

漏洞修复总结 漏洞概述 类型：安全漏洞（Security Fix） 标题： 提交：Commit ，作者 ，提交于 6月24日 关联：PR #20238，分支 → 本质：ZIP 下载过程中存在符号链接（symlink）泄漏风险，攻击者可通过构造恶意 ZIP 包中的符号链接，使下载文件指向系统其他路径，造成信息泄漏或越权访问。 影响范围 受影响模块： 、 、 、 、 、 受影响功能：ZIP 下载、文件路径解析、符号链接处理、路径规范化（ 、 、 等） 影响版本： 至 之间的版本 修复方案 1. 路径校验增强：在 中新增/修改 、 、 等函数，对下载文件路径进行严格校验，防止符号链接逃逸出预期目录。 2. ZIP 下载逻辑加固：在 中新增测试用例，验证 ZIP 下载时符号链接不会指向 等外部路径。 3. 元数据与路径排除：在 中通过 、 等常量排除特定路径，避免符号链接指向元数据目录。 4. 测试覆盖：在 中新增 与 ，覆盖 ZIP 上传/下载场景下的符号链接行为。 POC / 利用代码 截图中未包含独立的 POC 代码块，但以下测试代码体现了漏洞触发与验证逻辑： ```python webble/trans/test_views.py class ZipUploadTest(TestCase): def test_zip_download_validates_symlink_file(self): sentinel = 'outside-resolver' with TemporaryDirectory() as root_name, TemporaryDirectory() as outside_name: outside = Path(outside_name) (root / 'git' / 'config').write_bytes(b'repository metadata') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'sqlar' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_modules' / 'translation.txt').write_bytes(b'directory') (root / 'code_m

目標達成すべての支援者に感謝 — 100%達成しました！

Webble: Fix symlink leaks in ZIP downloads with enhanced path validation

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Webble: Fix symlink leaks in ZIP downloads with enhanced path validation

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！