diff options
Diffstat (limited to 'libmat2/exiftool.py')
| -rw-r--r-- | libmat2/exiftool.py | 24 |
1 files changed, 10 insertions, 14 deletions
diff --git a/libmat2/exiftool.py b/libmat2/exiftool.py index e17d31b..331ae0c 100644 --- a/libmat2/exiftool.py +++ b/libmat2/exiftool.py | |||
| @@ -5,7 +5,7 @@ import shutil | |||
| 5 | import subprocess | 5 | import subprocess |
| 6 | import tempfile | 6 | import tempfile |
| 7 | 7 | ||
| 8 | from typing import Dict, Union, Set | 8 | from typing import Dict, Union, Set, Callable, Any |
| 9 | 9 | ||
| 10 | from . import abstract | 10 | from . import abstract |
| 11 | 11 | ||
| @@ -20,27 +20,23 @@ class ExiftoolParser(abstract.AbstractParser): | |||
| 20 | """ | 20 | """ |
| 21 | meta_whitelist = set() # type: Set[str] | 21 | meta_whitelist = set() # type: Set[str] |
| 22 | 22 | ||
| 23 | @staticmethod | 23 | def _handle_problematic_filename(self, callback: Callable[[str], Any]) -> bytes: |
| 24 | def __handle_problematic_filename(filename: str, callback) -> bytes: | 24 | """ This method takes a filename with a potentially problematic name, |
| 25 | """ This method takes a filename with a problematic name, | 25 | and safely applies a `callback` to it. |
| 26 | and safely applies it a `callback`.""" | 26 | """ |
| 27 | if re.search('^[a-z0-9/]', self.filename) is not None: | ||
| 28 | return callback(self.filename) | ||
| 29 | |||
| 27 | tmpdirname = tempfile.mkdtemp() | 30 | tmpdirname = tempfile.mkdtemp() |
| 28 | fname = os.path.join(tmpdirname, "temp_file") | 31 | fname = os.path.join(tmpdirname, "temp_file") |
| 29 | shutil.copy(filename, fname) | 32 | shutil.copy(self.filename, fname) |
| 30 | out = callback(fname) | 33 | out = callback(fname) |
| 31 | shutil.rmtree(tmpdirname) | 34 | shutil.rmtree(tmpdirname) |
| 32 | return out | 35 | return out |
| 33 | 36 | ||
| 34 | def get_meta(self) -> Dict[str, Union[str, dict]]: | 37 | def get_meta(self) -> Dict[str, Union[str, dict]]: |
| 35 | """ There is no way to escape the leading(s) dash(es) of the current | ||
| 36 | self.filename to prevent parameter injections, so we need to take care | ||
| 37 | of this. | ||
| 38 | """ | ||
| 39 | fun = lambda f: subprocess.check_output([_get_exiftool_path(), '-json', f]) | 38 | fun = lambda f: subprocess.check_output([_get_exiftool_path(), '-json', f]) |
| 40 | if re.search('^[a-z0-9/]', self.filename) is None: | 39 | out = self._handle_problematic_filename(fun) |
| 41 | out = self.__handle_problematic_filename(self.filename, fun) | ||
| 42 | else: | ||
| 43 | out = fun(self.filename) | ||
| 44 | meta = json.loads(out.decode('utf-8'))[0] | 40 | meta = json.loads(out.decode('utf-8'))[0] |
| 45 | for key in self.meta_whitelist: | 41 | for key in self.meta_whitelist: |
| 46 | meta.pop(key, None) | 42 | meta.pop(key, None) |
