tarfile hardlink fallback ignores custom extraction filter rejection via None #157265
Copy link
Copy link
Closed
Labels
3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue
Description
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link.
For one of the calls, the return value is ignored. Instead, the member should be skipped if either call returns None.
Linked PRs
- gh-157265: Honor None result of filter for link fallbacks #157266
- [3.10] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157304
- [3.12] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157305
- [3.11] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157306
- [3.14] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157307
- [3.13] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157308
- [3.15] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) #157309
- gh-157265: Adjust test for Windows #157334
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue
Projects
- StatusShow more project fieldsDone
Activity
gh-157265: tarfile: Honor None result of filter for link fallbacks (G…
gh-157265: Adjust test for Windows (GH-157334)
pythongh-157265: tarfile: Honor None result of filter for link fallba…
pythongh-157265: Adjust test for Windows (pythonGH-157334)
2 remaining items
pythongh-157265: Adjust test for Windows (pythonGH-157334)
pythongh-157265: Adjust test for Windows (pythonGH-157334)
pythongh-157265: Adjust test for Windows (pythonGH-157334)
pythongh-157265: Adjust test for Windows (pythonGH-157334)
pythongh-157265: Adjust test for Windows (pythonGH-157334)
pythongh-157265: Adjust test for Windows (pythonGH-157334)
[3.13] gh-157265: tarfile: Honor None result of filter for link fallb…
[3.12] gh-157265: tarfile: Honor None result of filter for link fallb…
[3.10] gh-157265: tarfile: Honor None result of filter for link fallb…
[3.11] gh-157265: tarfile: Honor None result of filter for link fallb…
[3.14] gh-157265: tarfile: Honor None result of filter for link fallb…
[3.15] gh-157265: tarfile: Honor None result of filter for link fallb…