Skip to content

Commit 4090063

Browse files
Make the destination link check lexical
1 parent 607f0ab commit 4090063

2 files changed

Lines changed: 4 additions & 3 deletions

File tree

‎Doc/library/tarfile.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1132,7 +1132,7 @@ reused in custom filters:
11321132
path (after following symlinks) would end up outside the destination.
11331133
This raises :class:`~tarfile.OutsideDestinationError`.
11341134
- :ref:`Refuse <tarfile-extraction-refuse>` to extract links (hard or soft)
1135-
whose path resolves to the destination directory itself.
1135+
whose name refers to the destination directory itself.
11361136
This raises :class:`~tarfile.OutsideDestinationError`.
11371137
Note that such files are refused even on platforms that do not support
11381138
symbolic links.

‎Lib/tarfile.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -848,10 +848,11 @@ def _get_filtered_attrs(member, dest_path, for_data=True):
848848
strict=os.path.ALLOW_MISSING)
849849
if os.path.commonpath([target_path, dest_path]) != dest_path:
850850
raise OutsideDestinationError(member, target_path)
851-
# A link member that resolves to the destination directory itself
851+
# A link member named after the destination directory itself
852852
# would replace it with a (sym)link, redirecting the destination
853853
# for all subsequent members.
854-
if (member.islnk() or member.issym()) and target_path == dest_path:
854+
if ((member.islnk() or member.issym())
855+
and os.path.normpath(name) == os.curdir):
855856
raise OutsideDestinationError(member, target_path)
856857
# Limit permissions (no high bits, and go-w)
857858
mode = member.mode

0 commit comments

Comments
 (0)