@@ -474,6 +474,15 @@ def _ensure_parent_dir(self, path: Path):
474474 def _get_extraction_path (self , path : Path , path_use_description : str ) -> Path :
475475 fs_path = self ._fs_path (path )
476476
477+ if fs_path .absolute_path .exists ():
478+ report = ExtractionProblem (
479+ path = str (fs_path .relative_path ),
480+ problem = f"Attempting to create a file that already exists through { path_use_description } " ,
481+ resolution = "Overwrite." ,
482+ )
483+ fs_path .absolute_path .unlink ()
484+ self .record_problem (report )
485+
477486 if not fs_path .is_safe :
478487 report = PathTraversalProblem (
479488 path = str (fs_path .relative_path ),
@@ -540,11 +549,16 @@ def mknod(self, path: Path, mode=0o600, device=0):
540549
541550 def _get_checked_link (self , src : Path , dst : Path ) -> Optional [_FSLink ]:
542551 link = _FSLink (root = self .root , src = src , dst = dst )
543- if link .is_safe :
544- return link
545552
546- self .record_problem (link .format_report ("Potential path traversal through link" ))
547- return None
553+ if link .src .absolute_path .exists ():
554+ self .record_problem (link .format_report ("File already exists." ))
555+ return None
556+ if not link .is_safe :
557+ self .record_problem (
558+ link .format_report ("Potential path traversal through link" )
559+ )
560+ return None
561+ return link
548562
549563 def _path_to_root (self , from_dir : Path ) -> Path :
550564 # This version does not look at the existing symlinks, so while it looks cleaner it is also
0 commit comments