From 143705f2a7500adc90cfb61b566d0fac329755d9 Mon Sep 17 00:00:00 2001 From: Kovid Goyal Date: Sun, 24 Nov 2024 21:49:36 +0530 Subject: [PATCH] Specify filter explicitly when extracting tarfiles in ci script --- .github/workflows/ci.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.py b/.github/workflows/ci.py index 67abad6a0..3c3b5bf78 100644 --- a/.github/workflows/ci.py +++ b/.github/workflows/ci.py @@ -67,11 +67,17 @@ def install_fonts() -> None: fonts_dir = os.path.expanduser('~/Library/Fonts' if is_macos else '~/.local/share/fonts') os.makedirs(fonts_dir, exist_ok=True) with tarfile.open(fileobj=io.BytesIO(data), mode='r:xz') as tf: - tf.extractall(fonts_dir) + try: + tf.extractall(fonts_dir, filter='fully_trusted') + except TypeError: + tf.extractall(fonts_dir) with urlopen(NERD_URL) as f: data = f.read() with tarfile.open(fileobj=io.BytesIO(data), mode='r:xz') as tf: - tf.extractall(fonts_dir) + try: + tf.extractall(fonts_dir, filter='fully_trusted') + except TypeError: + tf.extractall(fonts_dir) def install_deps() -> None: @@ -155,7 +161,10 @@ def install_bundle() -> None: with urlopen(BUNDLE_URL.format('macos' if is_macos else 'linux')) as f: data = f.read() with tarfile.open(fileobj=io.BytesIO(data), mode='r:xz') as tf: - tf.extractall() + try: + tf.extractall(filter='fully_trusted') + except TypeError: + tf.extractall() if not is_macos: replaced = 0 for dirpath, dirnames, filenames in os.walk('.'):