FIX: Avoid directory clobber during zip extraction

templateflow · Mar 18, 2024 · 7ede8f2 · 7ede8f2
1 parent b172865
commit 7ede8f2
Showing 1 changed file with 14 additions and 9 deletions.
diff --git a/templateflow/conf/_s3.py b/templateflow/conf/_s3.py
@@ -80,23 +80,28 @@ def _update_skeleton(skel_file, dest, overwrite=True, silent=False):
     dest = Path(dest)
     dest.mkdir(exist_ok=True, parents=True)
     with ZipFile(skel_file, 'r') as zipref:
+        allfiles = sorted(zipref.namelist())
+
         if overwrite:
-            zipref.extractall(str(dest))
-            return True
+            newfiles = allfiles
+        else:
+            current_files = [s.relative_to(dest) for s in dest.glob('**/*')]
+            existing = sorted({'%s/' % s.parent for s in current_files}) + [
+                str(s) for s in current_files
+            ]
+            newfiles = sorted(set(allfiles) - set(existing))
 
-        allfiles = zipref.namelist()
-        current_files = [s.relative_to(dest) for s in dest.glob('**/*')]
-        existing = sorted({'%s/' % s.parent for s in current_files}) + [
-            str(s) for s in current_files
-        ]
-        newfiles = sorted(set(allfiles) - set(existing))
         if newfiles:
             if not silent:
                 print(
                     'Updating TEMPLATEFLOW_HOME using S3. Adding:\n%s'
                     % '\n'.join(newfiles)
                 )
-            zipref.extractall(str(dest), members=newfiles)
+            for fl in newfiles:
+                localpath = dest / fl
+                if localpath.is_dir():  # avoid extracting existing directories
+                    continue
+                zipref.extract(fl, path=dest)
             return True
     if not silent:
         print('TEMPLATEFLOW_HOME directory (S3 type) was up-to-date.')