[SOLVED] Problem with package installation

[Joshua]

Good morning,

I'm trying to port a package to version 2.6
An error occurs and I'm a bit stuck; the source code is fine, regardless of the method used (Python script, PowerShell)

Security problem due to a particular file?

If you have any ideas, I'm all ears, thank you!

Code: Select all

Traceback (most recent call last):
  File "C:\Program Files (x86)\wapt\common.py", line 4364, in install_wapt
    packagetempdir = entry.unzip_package(cabundle=self.cabundle, target_dir = tempfile.mkdtemp(prefix='wapt',dir=self.wapt_temp_dir))
  File "C:\Program Files (x86)\wapt\waptpackage.py", line 2652, in unzip_package
    raise EWaptCorruptedFiles('Unzip: Unsafe filename %s in zip package file %s' % (fn,self.localpath))
waptpackage.EWaptCorruptedFiles: Unzip: Unsafe filename ActivInspire/Program Files 64/Activ Software/Inspire/apps/ActivityBuilder/static/media/javascript,__webpack_public_path__ = __webpack_base_uri__ = htmlWebpackPluginPublicPath;.bin in zip package file C:\Program Files (x86)\wapt\private\cache\xyz-activinspiresuite-3.5_3.5.18-3_x64_windows_10.0_PROD.wapt
 
EWaptCorruptedFiles: Unzip: Unsafe filename ActivInspire/Program Files 64/Activ Software/Inspire/apps/ActivityBuilder/static/media/javascript,__webpack_public_path__ = __webpack_base_uri__ = htmlWebpackPluginPublicPath;.bin in zip package file C:\Program Files (x86)\wapt\private\cache\xyz-activinspiresuite-3.5_3.5.18-3_x64_windows_10.0_PROD.wapt

[sfonteneau]

Good morning

That's very strange

One of the files contained in the zip archive has the following format:

Code: Select all

ActivInspire/Program Files 64/Activ Software/Inspire/apps/ActivityBuilder/static/media/javascript,__webpack_public_path__ = __webpack_base_uri__ = htmlWebpackPluginPublicPath;.bin

Literally... and that's clearly not a valid filename.

How was the package built?

[Joshua]

Hello,

the package was created manually, without using the WAPT console, and by following the editor's process:

https://support.prometheanworld.com/s/a ... anguage=fr


Best regards,
Joshua

[sfonteneau]

I just checked:

Code: Select all

ActivInspire/Program Files 64/Activ Software/Inspire/apps/ActivityBuilder/static/media/javascript,__webpack_public_path__ = __webpack_base_uri__ = htmlWebpackPluginPublicPath;.bin

It does exist, but it looks more like a mistake by the editor than a real filename

Try deleting it (I don't think the app uses it)

[Joshua]

I had already tried renaming the file,
but the MSI returns error code 1603
: Product: ActivInspire v3.5.18 -- Installation operation failed.

Therefore, the installation cannot proceed.
If the file is present, the installation proceeds correctly; I use PowerShell to perform the installation.

[sfonteneau]

A temporary workaround would be to rename the file before building and then rename it back to its original name just before installation (in setup.py).

You're falling into Wapt's security trap; basically, we mainly want to avoid / .. \ ~ etc. which cause "Path Traversal" type attacks

Here you will encounter this piece of code:

Code: Select all

        if c in '|:<>*?;`\n':
            return True

Here it's the semicolon that's blocked

Normally, if I look at it correctly, it's not dangerous here.

We need to see how we can be more permissive in Wapt without adding a security problem.

[Joshua]

Hi,

great, thanks for the tip, it worked!

Joshua