Guard against arbitrary file retrieval.
543737
def _is_under_root(self, full_path):
        """"""
        if (path.abspath(full_path) + path.sep)\
                .startswith(path.abspath(self.root) + path.sep):
            return True
        else:
            return False
1334995
def lock_file(filename, interval=.5, timeout=15):
    '''
    
    '''
    log.trace('Attempting to obtain lock for %s', filename)
    lock = filename + '.lock'
    start = time.time()
    while True:
        if os.path.exists(lock):
            if time.time() - start >= timeout:
                log.warning('Unable to obtain lock for %s', filename)
                return False
            time.sleep(interval)
        else:
            break

    with salt.utils.files.fopen(lock, 'a'):
        pass
904167
function ensureDir(dir) {
        try {
            if (!fs_1.existsSync(dir))
                fs_1.mkdirSync(dir);
            return true;
        }
        catch (ex) {
            return false;
        }
    }
497246
def safe_delete(filename):
  """"""
  try:
    os.unlink(filename)
  except OSError as e:
    if e.errno != errno.ENOENT:
      raise
268891
def _filter(self, filename):
        
        return self.name_filter is not None and re.search(self.name_filter, filename) is None
1203995
def files_auth(request):
    """"""
    if "password" in request.POST:
        """
            Encrypt the password with AES mode CFB.
            Create a random 32 char key, stored in a CLIENT-side cookie.
            Create a random 32 char IV, stored in a SERVER-side session.
            Store the encrypted ciphertext in a SERVER-side session.

            This ensures that neither side can decrypt the password without
            the information stored on the other end of the request.

            Both the server-side session variables and the client-side cookies
            are deleted when the user logs out.
        """
        key = Random.new().read(32)
        iv = Random.new().read(16)
        obj = AES.new(key, AES.MODE_CFB, iv)
        message = request.POST.get("password")
        if isinstance(message, str):
            message = message.encode("utf-8")
        ciphertext = obj.encrypt(message)
        request.session["files_iv"] = base64.b64encode(iv).decode()
        request.session["files_text"] = base64.b64encode(ciphertext).decode()
        cookie_key = base64.b64encode(key).decode()

        nexturl = request.GET.get("next", None)
        if nexturl and nexturl.startswith("/files"):
            response = redirect(nexturl)
        else:
            response = redirect("files")
        response.set_cookie(key="files_key", value=cookie_key)
        if "username" in request.POST:
            request.session["filecenter_username"] = request.POST.get("username")
        return response
    else:
        return render(request, "files/auth.html", {"is_admin": request.user.member_of("admin_all")})
505338
def embeddedFileAdd(self, buffer, name, filename=None, ufilename=None, desc=None):
        """"""

        if self.isClosed or self.isEncrypted:
            raise ValueError("operation illegal for closed / encrypted doc")


        return _fitz.Document_embeddedFileAdd(self, buffer, name, filename, ufilename, desc)
1084626
def _exclusive_lock(path):
    """"""
    _create_file_dirs(path)
    fd = os.open(path, os.O_WRONLY | os.O_CREAT, 0o600)

    try:
        retries_left = _LOCK_RETRIES
        success = False

        while retries_left > 0:
            # try to acquire the lock in a loop
            # because gevent doesn't treat flock as IO,
            # so waiting here without yielding would get the worker killed
            try:
                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
                success = True
                break
            except IOError as e:
                if e.errno in [errno.EAGAIN, errno.EWOULDBLOCK]:
                    # This yields execution to other green threads.
                    gevent.sleep(_LOCK_SLEEP_TIME_S)
                    retries_left -= 1
                else:
                    raise

        if success:
            yield
        else:
            raise ConcurrentModificationError(path)
    finally:
        if success:
            fcntl.flock(fd, fcntl.LOCK_UN)
        os.close(fd)
812412
def download_file_insecure(url, target):
    """"""
    src = urlopen(url)
    try:
        # Read all the data in one block.
        data = src.read()
    finally:
        src.close()

    # Write all the data in one block to avoid creating a partial file.
    with open(target, "wb") as dst:
        dst.write(data)
908917
private void handleArchiveByFile(Predicate<String> filter, File archive, List<String> discoveredFiles)
    {
        try
        {
            try (ZipFile zip = new ZipFile(archive))
            {
                Enumeration<? extends ZipEntry> entries = zip.entries();
                
                while (entries.hasMoreElements())
                {
                    ZipEntry entry = entries.nextElement();
                    String name = entry.getName();
                    if (filter.accept(name))
                        discoveredFiles.add(name);
                }
            }
        }
        catch (IOException e)
        {
            throw new RuntimeException("Error handling file " + archive, e);
        }
    }
822632
def file_should_be_skipped(
    filename: str,
    config: Mapping[str, Any],
    path: str = ''
) -> bool:
    """"""
    os_path = os.path.join(path, filename)

    normalized_path = os_path.replace('\\', '/')
    if normalized_path[1:2] == ':':
        normalized_path = normalized_path[2:]

    if path and config['safety_excludes']:
        check_exclude = '/' + filename.replace('\\', '/') + '/'
        if path and os.path.basename(path) in ('lib', ):
            check_exclude = '/' + os.path.basename(path) + check_exclude
        if safety_exclude_re.search(check_exclude):
            return True

    for skip_path in config['skip']:
        if posixpath.abspath(normalized_path) == posixpath.abspath(skip_path.replace('\\', '/')):
            return True

    position = os.path.split(filename)
    while position[1]:
        if position[1] in config['skip']:
            return True
        position = os.path.split(position[0])

    for glob in config['skip_glob']:
        if fnmatch.fnmatch(filename, glob) or fnmatch.fnmatch('/' + filename, glob):
            return True

    if not (os.path.isfile(os_path) or os.path.isdir(os_path) or os.path.islink(os_path)):
        return True

    return False
95969
def tamper_file_at(path, pos=0, replace_str=None):
    
    if not replace_str:
        replace_str = "\x00"
    try:
        with open(path, "r+b") as fh:
            if pos < 0: # if negative, we calculate the position backward from the end of file
                fsize = os.fstat(fh.fileno()).st_size
                pos = fsize + pos
            fh.seek(pos)
            fh.write(replace_str)
    except IOError:
        return False
    finally:
        try:
            fh.close()
        except Exception:
            pass
    return True
1143879
def keyscan(state, host, hostname, force=False):
    '''
    
    '''

    yield files.directory(
        state, host,
        '~/.ssh',
        mode=700,
    )

    hostname_present = host.fact.find_in_file(
        '~/.ssh/known_hosts',
        hostname,
    )

    keyscan_command = 'ssh-keyscan {0} >> ~/.ssh/known_hosts'.format(hostname)

    if not hostname_present:
        yield keyscan_command

    elif force:
        yield 'ssh-keygen -R {0}'.format(hostname)
        yield keyscan_command
926005
def allow_rwe(self, name):
        """"""
        assert name in PERMISSIONS.keys()
        os.chmod(self.file_path, PERMISSIONS[name]['all'])
424899
def validate(self, path):
        """"""
        # Exclude hidden files and folders with '.' prefix
        if os.path.basename(path).startswith('.'):
            return False

        # Check that current path level is more than min path and less than max path
        if not self.check_level(path):
            return False

        if self.filters:
            if not self._level_filters(path):
                return False

        # Force include and exclude iterations to be strings in case of integer filters
        # Handle exclusions
        if self.to_exclude:
            if any(str(ex).lower() in path.lower() for ex in self.to_exclude):
                return False

        # Handle inclusions
        if self.to_include:
            if not any(str(inc).lower() in path.lower() for inc in self.to_include):
                return False

        return True
573061
def encrypt_file(src, dest, csv_keys):
    """"""
    keys = massage_keys(csv_keys.split(','))
    cryptorito.encrypt(src, dest, keys)
89843
def pull_arbitrary(collector, image, **kwargs):
    """"""
    image_index_of = lambda image: urlparse("https://{0}".format(image)).netloc

    if image.startswith("file://"):
        parsed = urlparse(image)
        filename = parsed.netloc + parsed.path
        if not os.path.exists(filename):
            raise HarpoonError("Provided file doesn't exist!", wanted=image)
        with open(filename) as fle:
            image_indexes = [(line.strip(), image_index_of(line.strip())) for line in fle]
    else:
        image_indexes = [(image, image_index_of(image))]

    authentication = collector.configuration.get("authentication", NotSpecified)
    for index, (image, image_index) in enumerate(image_indexes):
        tag = sb.NotSpecified
        if ":" in image:
            image, tag = image.split(":", 1)

        image = {
              "image_name": image
            , "tag": tag
            , "harpoon": collector.configuration["harpoon"]
            , "commands": ["FROM scratch"]
            , "image_index": image_index
            , "assume_role": NotSpecified
            , "authentication": authentication
            }
        meta = Meta(collector.configuration, []).at("images").at("__arbitrary_{0}__".format(index))
        image = HarpoonSpec().image_spec.normalise(meta, image)
        Syncer().pull(image)