mindsdb arbitrary file write when extracting a remotely retrieved Tarball

Summary

An unsafe extraction is being performed using tarfile.extractall() from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant.

Details

I commented the following snippet of code as a vulnerability details. The code is from file.py#L26..L134

@ns_conf.route('/')
@ns_conf.param('name', "MindsDB's name for file")
class File(Resource):
    @ns_conf.doc('put_file')
    def put(self, name: str):
        ''' add new file
            params in FormData:
                - file
                - original_file_name [optional]
        '''

        data = {}

        ... omitted for brevity

            url = data['source']
            data['file'] = data['name']

            ... omitted for brevity 

            with requests.get(url, stream=True) as r:                   # Source: retrieve the URL which point to a remotely located tarball 
                if r.status_code != 200:
                    return http_error(
                        400,
                        "Error getting file",
                        f"Got status code: {r.status_code}"
                    )
                file_path = os.path.join(temp_dir_path, data['file'])
                with open(file_path, 'wb') as f:…