Cutlery/calibre
1
0
Fork 0
mirror of https://github.com/kovidgoyal/calibre.git synced 2026-03-06 00:43:42 -05:00
Code Issues Packages Projects Releases Wiki Activity

EPUB Input: Ensure font obfuscation processing happens only on files from the EPUB

Browse Source
This commit is contained in:
Kovid Goyal 2026-02-02 09:51:18 +05:30
parent ffa20c1735
commit 267bfd3402
No known key found for this signature in database
GPG Key ID: 06BC317B515ACE7C
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/calibre/ebooks/conversion/plugins/epub_input.py
View File

@ -44,6 +44,8 @@ class EPUBInput(InputFormatPlugin):
import uuid
from lxml import etree
from calibre.utils.filenames import is_existing_subpath
idpf_key = opf.raw_unique_identifier
if idpf_key:
idpf_key = re.sub(r'[ \t\r\n]', '', idpf_key)
@ -74,7 +76,7 @@ class EPUBInput(InputFormatPlugin):
uri = cr.get('URI')
path = os.path.abspath(os.path.join(os.path.dirname(encfile), '..', *uri.split('/')))
tkey = (key if algorithm == ADOBE_OBFUSCATION else idpf_key)
if (tkey and os.path.exists(path)):
if (tkey and is_existing_subpath(path, os.getcwd())):
self._encrypted_font_uris.append(uri)
decrypt_font(tkey, path, algorithm)
return True

14
src/calibre/utils/filenames.py
View File

@ -631,6 +631,20 @@ def copytree_using_links(path, dest, dest_is_parent=True, filecopyfunc=copyfile)
filecopyfunc(src, df)
def is_existing_subpath(child: str, parent: str) -> bool:
' Check if child is under parent. If either child or parent dont exist, returns False. '
try:
parent = os.path.realpath(parent, strict=True) # resolve symlinks
child = os.path.realpath(child, strict=True)
except OSError:
return False
parent = os.path.abspath(parent)
child = os.path.abspath(child)
if not parent.endswith(os.sep):
parent += os.sep
return child.startswith(parent)
rmtree = shutil.rmtree