GHSA-wvrh-2f4m-924v

## Summary ChatterBot's `UbuntuCorpusTrainer.extract()` uses a predictable, home-rooted output directory (`~/ubuntu_data/ubuntu_dialogs`) with a check-then-create pattern (`if not os.path.exists: os.makedirs`) followed by `tar.extractall(path=self.data_path)`. A local attacker who pre-plants a symlink at the predictable path causes `os.path.exists()` to return True (following the symlink), skipping `makedirs`, and subsequent `extractall` writes archive contents through the symlink to the attacker-chosen directory. The existing `safe_extract` function validates tar **member names** (zip-slip defense) but does not validate the **output directory** itself — it cannot detect that `self.data_path` is a symlink. This is the defining distinction between the archive_extraction (zip-slip) and insecure_fs_create_toctou families. ## Vulnerability Details ### Predictable output directory (line 535-546) ```python home_directory = os.path.expanduser('~') self.data_directory = kwargs.get( 'ubuntu_corpus_data_directory', os.path.join(home_directory, 'ubuntu_data') # ~/ubuntu_data — predictable ) self.data_path = os.path.join( self.data_directory, 'ubuntu_dialogs' # ~/ubuntu_data/ubuntu_dialogs ) ``` ### Check-then-create (line 621-622) ```python def extract(self, file_path: str): if not os.path.exists(self.data_path): # ← follows symlink → True → skips makedirs os.makedirs(self.data_path) # ← never reached if symlink exists ``` ### Extraction through symlink (line 633-644) ```python def safe_extract(tar, path='.', members=None, *, numeric_owner=False): for member in tar.getmembers(): member_path = os.path.join(path, member.name) if not is_within_directory(path, member_path): # ← validates MEMBER names only raise Exception('Attempted Path Traversal in Tar File') tar.extractall(path, members, numeric_owner=numeric_owner) # ← path is symlink → writes to target safe_extract(tar, path=self.da