Skip to content

fix: raise clear errors on corrupt or malicious DOCX parsing #1583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ChenfromChina123 wants to merge 1 commit into from
Closed

fix: raise clear errors on corrupt or malicious DOCX parsing #1583

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions src/docx/opc/phys_pkg.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
"""Provides a general interface to a `physical` OPC package, such as a zip file."""

import os
from zipfile import ZIP_DEFLATED, ZipFile, is_zipfile
import zlib
from zipfile import ZIP_DEFLATED, BadZipFile, ZipFile, is_zipfile

from docx.opc.exceptions import PackageNotFoundError
from docx.opc.packuri import CONTENT_TYPES_URI
Expand Down Expand Up @@ -73,14 +74,25 @@ class _ZipPkgReader(PhysPkgReader):

def __init__(self, pkg_file):
super(_ZipPkgReader, self).__init__()
self._zipf = ZipFile(pkg_file, "r")
try:
self._zipf = ZipFile(pkg_file, "r")
except (BadZipFile, zlib.error, EOFError, RuntimeError):
raise PackageNotFoundError(
"Package not found or not a valid zip archive: '%s'" % pkg_file
)

def blob_for(self, pack_uri):
"""Return blob corresponding to `pack_uri`.

Raises |ValueError| if no matching member is present in zip archive.
"""
return self._zipf.read(pack_uri.membername)
try:
return self._zipf.read(pack_uri.membername)
except (KeyError, zlib.error, EOFError, RuntimeError):
raise ValueError(
"Could not read member '%s' from package (corrupt or missing?)"
% pack_uri.membername
)

def close(self):
"""Close the zip archive, releasing any resources it is using."""
Expand Down