🔒 [Security Fix] Resolve Path Traversal Vulnerability in tarfile.extractall by akutuva21 · Pull Request #110 · akutuva21/PyBioNetGen

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

akutuva21 · 2026-04-13T13:54:31Z

🎯 What: Fixed a CWE-22 Path Traversal (TarSlip) vulnerability in setup.py where tarfile.extractall() was called on an unverified archive.
⚠️Risk: A maliciously crafted archive downloaded during setup could exploit the vulnerability to write arbitrary files outside of the intended extraction directory (e.g., /etc/passwd or ~/.ssh/authorized_keys), leading to remote code execution or system compromise.
🛡️ Solution: Implemented a robust safe_extract wrapper that iterates through all members of the tarball and securely verifies each target path using os.path.commonpath. Furthermore, the solution smartly delegates to native protection by using filter='data' if the environment is running Python 3.12+. All instances of bng_arch.extractall() have been replaced with safe_extract(bng_arch).

PR created automatically by Jules for task 12333539346323582647 started by @akutuva21

Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

google-labs-jules · 2026-04-13T13:54:32Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

ActionList.define_parser's list-valued argument grammar was stricter than BNG2.pl/Perl: arg_type_list matched elements with `pp.Word(pp.nums + ".")` (digits and '.' only) inside a plain `pp.delimitedList`, so it rejected - scientific notation, e.g. par_scan_vals=>[2.3e-10,5.1e-10] - a trailing comma, e.g. par_scan_vals=>[1,2,3,] Both are valid Perl that BNG2.pl parses and runs. When a model used either (commonly par_scan_vals on parameter_scan), modelapi.bngmodel raised BNGParseError, so under simulator='bngsim' the bridge couldn't inspect the actions and silently fell back to the legacy subprocess (the #109 class) — the model never ran on bngsim. Real models hit this: RuleHub's Mitra2019/15-igf1r fits and Salazar-Cavazos2019 CHO_EGFR best-fit. Broaden arg_type_list to use arg_type_expr (which already spans e/E and +/-), allow an empty list, and tolerate one optional trailing comma: arg_type_list = "[" + Optional(delimitedList(quote_word ^ arg_type_expr)) + Optional(",") + "]" Still rejects genuinely-malformed lists (double commas `[1,,2]`, unclosed `[1,2,`). Adds parametrized accept/reject tests over the issue's matrix and the affected real-model forms.

Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)

Resolved conflicts in: - bionetgen/core/utils/utils.py: kept upstream's e-notation and trailing comma support for list args (fixes#110) - bionetgen/modelapi/bngparser.py: combined verbose flag with BNGPATH parameter - bionetgen/modelapi/model.py: combined verbose flag with simplified upstream init - bionetgen/network/network.py: kept module-level logger initialization - bionetgen/simulator/csimulator.py: combined get_conf with BNGSimulatorError import - tests/test_bng_parsing.py: kept both exception tests and parametrized grammar tests

fix: resolve path traversal vulnerability in setup.py extractall
568704c
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>

chore: PR#110remove forbidden artifacts and run black
9c76575

This was referenced Apr 13, 2026
🔒 Fix Arbitrary File Overwrite via tarfile.extractall in setup.py #17
Closed
🔒 Fix arbitrary file overwrite vulnerability in setup.py tar extraction #61
Closed

akutuva21 merged commit a835639 into mainApr 13, 2026
18 checks passed

akutuva21 deleted the fix/setup-path-traversal-12333539346323582647 branch April 13, 2026 14:30

akutuva21 pushed a commit that referenced this pull request Jul 20, 2026
Merge pull request#111from wshlavacek/fix/bngsim-bridge-routing-issues
d40470c
Fix BNGsim bridge silent fallbacks: strict routing error (#109) + Perl-faithful list-arg grammar (#110)