New submission from Artem Bulgakov <artemsbulga...@ya.ru>:
tarfile sets FNAME field to the path given by user: Lib/tarfile.py:424
It writes full path instead of just basename if user specified absolute path.
Some archive viewer apps like 7-Zip may process file incorrectly. Also it
creates security issue because anyone can know structure of directories on
system and know username or other personal information.
You can reproduce this by running below lines in Python interpreter. Tested on
Windows and Linux.
Python 3.8.2 (default, Apr 27 2020, 15:53:34)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> import tarfile
>>> open("somefile.txt", "w").write("sometext")
8
>>> tar = tarfile.open("/home/bulgakovas/file.tar.gz", "w|gz")
>>> tar.add("somefile.txt")
>>> tar.close()
>>> open("file.tar.gz", "rb").read()[:50]
b'\x1f\x8b\x08\x08cE\x10_\x02\xff/home/bulgakovas/file.tar\x00\xed\xd3M\n\xc20\x10\x86\xe1\xac=EO\x90'
You can see full path to file.tar (/home/bulgakovas/file.tar) as FNAME field.
If you will write just tarfile.open("file.tar.gz", "w|gz"), FNAME will be equal
to file.tar.
RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory
components removed.
So tarfile must remove directory names from FNAME and write only basename of
file.
----------
components: Library (Lib)
messages: 373759
nosy: ArtemSBulgakov, lars.gustaebel
priority: normal
severity: normal
status: open
title: tarfile: Do not write full path in FNAME field
type: behavior
versions: Python 3.10, Python 3.5, Python 3.6, Python 3.7, Python 3.8, Python
3.9
_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue41316>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
