Skip to content

gh-160097: Reject links replacing the destination in tarfile.tar_filter - #160098

Merged
StanFromIreland merged 3 commits into
python:mainfrom
StanFromIreland:tarfile-tar-filt-fix
Oct 22, 2026
Merged

gh-160097: Reject links replacing the destination in tarfile.tar_filter#160098
StanFromIreland merged 3 commits into
python:mainfrom
StanFromIreland:tarfile-tar-filt-fix

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Oct 21, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Oct 21, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Oct 21, 2026
Open
@read-the-docs-community

read-the-docs-community Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35307573 | 📁 Comparing 4090063 against main (4869640)

  🔍 Preview build  

2 files changed
± library/tarfile.html
± whatsnew/changelog.html

StanFromIreland
StanFromIreland commented Oct 21, 2026
View reviewed changes
Comment thread Lib/tarfile.py
# would replace it with a (sym)link, redirecting the destination
# for all subsequent members.
if ((member.islnk() or member.issym())
and os.path.normpath(name) == os.curdir):

@StanFromIreland StanFromIreland Oct 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The old check compared the member's real path against the real path of the destination directory, this was incorrect. For example, a link named x was rejected whenever an earlier x -> . symlink existed, even though extracting it only replaces that symlink (and never touches the destination directory).

CC @gps-head

@sethmlarson sethmlarson Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @gpshead

encukou
encukou approved these changes Oct 22, 2026
View reviewed changes

@encukou encukou left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you.

@StanFromIreland
StanFromIreland merged commit e7e0b35 into python:main Oct 22, 2026
60 checks passed
@StanFromIreland
StanFromIreland deleted the tarfile-tar-filt-fix branch October 22, 2026 20:23
@miss-islington-app

miss-islington-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

GH-160339 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Oct 22, 2026
@bedevere-app

bedevere-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

GH-160340 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Oct 22, 2026
@bedevere-app

bedevere-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

GH-160341 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Oct 22, 2026
@bedevere-app

bedevere-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

GH-160342 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Oct 22, 2026
@bedevere-app

bedevere-app Bot commented Oct 22, 2026

Copy link
Copy Markdown

GH-160343 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Oct 22, 2026
StanFromIreland added a commit that referenced this pull request Oct 22, 2026
@miss-islington @StanFromIreland
[3.14] gh-160097: Reject links replacing the destination in `tarfile.…
0901ad4 
…tar_filter` (GH-160098) (#160340)

(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Oct 22, 2026
@miss-islington @StanFromIreland
[3.15] gh-160097: Reject links replacing the destination in `tarfile.…
c6ada40 
…tar_filter` (GH-160098) (#160339)

(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <stan@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou approved these changes
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner
@sethmlarson sethmlarson Awaiting requested review from sethmlarson

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@StanFromIreland @encukou @sethmlarson