)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"b02def3ad547a4accc637ad5b49e6c72351f2ba5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"18b503fa_0306d22a","updated":"2023-03-17 17:12:26.000000000","message":"backport without marking bifrost as unbuildable","commit_id":"3d008b7f5ec2a54d004e8e9370f303ef9dc7858b"},{"author":{"_account_id":9545,"name":"Andriy Kurilin","email":"andr.kurilin@gmail.com","username":"akurilin"},"change_message_id":"cefc2e470004829a1b35dfc239cbdb08f3721163","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"b28a3430_1c83225a","updated":"2023-03-30 11:51:09.000000000","message":"this commit broke our build with local \u0027additions\u0027. more details at https://review.opendev.org/c/openstack/kolla/+/879041","commit_id":"3d008b7f5ec2a54d004e8e9370f303ef9dc7858b"}],"kolla/image/tasks.py":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ca2479ff7c83dfc75138cc5cb15a9c51981dbb77","unresolved":true,"context_lines":[{"line_number":269,"context_line":"            for n in tar_file.getnames():"},{"line_number":270,"context_line":"                if not os.path.abspath(os.path.join(path, n)).startswith(path):"},{"line_number":271,"context_line":"                    tar_file.close()"},{"line_number":272,"context_line":"                    self.logger.exception(\u0027Unsafe filenames in archive \u0027"},{"line_number":273,"context_line":"                                          f\u0027{archive}\u0027)"},{"line_number":274,"context_line":"                    raise ArchivingError"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"f9aa1189_8c5daf0a","line":272,"range":{"start_line":272,"start_character":32,"end_line":272,"end_character":41},"updated":"2023-03-16 19:57:47.000000000","message":"This is to log an exception that has already been raised. Use error","commit_id":"c8d79e92e838e65adeffa26b1629d8df30b22b5d"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"c5a426bb67ceb87e1ff8415aa8fe8582b9243003","unresolved":false,"context_lines":[{"line_number":269,"context_line":"            for n in tar_file.getnames():"},{"line_number":270,"context_line":"                if not os.path.abspath(os.path.join(path, n)).startswith(path):"},{"line_number":271,"context_line":"                    tar_file.close()"},{"line_number":272,"context_line":"                    self.logger.exception(\u0027Unsafe filenames in archive \u0027"},{"line_number":273,"context_line":"                                          f\u0027{archive}\u0027)"},{"line_number":274,"context_line":"                    raise ArchivingError"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"121e4bcc_9e1373e9","line":272,"range":{"start_line":272,"start_character":32,"end_line":272,"end_character":41},"in_reply_to":"f9aa1189_8c5daf0a","updated":"2023-03-17 07:53:59.000000000","message":"Done","commit_id":"c8d79e92e838e65adeffa26b1629d8df30b22b5d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ca2479ff7c83dfc75138cc5cb15a9c51981dbb77","unresolved":true,"context_lines":[{"line_number":288,"context_line":"                for archive in archives:"},{"line_number":289,"context_line":"                    with tarfile.open(archive, \u0027r\u0027) as archive_tar:"},{"line_number":290,"context_line":"                        archive_tar.extractall(  # nosec"},{"line_number":291,"context_line":"                            members\u003d_test_malicious_tarball("},{"line_number":292,"context_line":"                                archive, items_path),"},{"line_number":293,"context_line":"                            path\u003ditems_path)"},{"line_number":294,"context_line":"            else:"},{"line_number":295,"context_line":"                try:"}],"source_content_type":"text/x-python","patch_set":6,"id":"12e54856_76bf5569","line":292,"range":{"start_line":291,"start_character":27,"end_line":292,"end_character":53},"updated":"2023-03-16 19:57:47.000000000","message":"I\u0027m not sure members is helping us here - we either need to bail or continue, not filter members. Presumably a members function should also return the filtered members, which the above does not.\n\nInstead, call _test_malicious_tarball before extractall and pass in archive_tar (no need to open in the function then)","commit_id":"c8d79e92e838e65adeffa26b1629d8df30b22b5d"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"c5a426bb67ceb87e1ff8415aa8fe8582b9243003","unresolved":false,"context_lines":[{"line_number":288,"context_line":"                for archive in archives:"},{"line_number":289,"context_line":"                    with tarfile.open(archive, \u0027r\u0027) as archive_tar:"},{"line_number":290,"context_line":"                        archive_tar.extractall(  # nosec"},{"line_number":291,"context_line":"                            members\u003d_test_malicious_tarball("},{"line_number":292,"context_line":"                                archive, items_path),"},{"line_number":293,"context_line":"                            path\u003ditems_path)"},{"line_number":294,"context_line":"            else:"},{"line_number":295,"context_line":"                try:"}],"source_content_type":"text/x-python","patch_set":6,"id":"be65940a_e3fe353b","line":292,"range":{"start_line":291,"start_character":27,"end_line":292,"end_character":53},"in_reply_to":"12e54856_76bf5569","updated":"2023-03-17 07:53:59.000000000","message":"Done","commit_id":"c8d79e92e838e65adeffa26b1629d8df30b22b5d"}]}