https://github.com/python/cpython/commit/aef7edaf23e2bda80746375c0a8a0a0cf671a3c0
commit: aef7edaf23e2bda80746375c0a8a0a0cf671a3c0
branch: 3.13
author: Miss Islington (bot) <31488909+miss-isling...@users.noreply.github.com>
committer: jaraco <jar...@jaraco.com>
date: 2025-03-08T21:43:12Z
summary:
[3.13] gh-123726: Document caveats of zipfile.Path around name sanitization
(GH-130537) (#130986)
gh-123726: Document caveats of zipfile.Path around name sanitization (GH-130537)
Add a note to the `zipfile.Path` class documentation clarifying that it does
not sanitize filenames. This emphasizes the caller's responsibility to validate
or sanitize inputs, especially when handling untrusted ZIP archives, to prevent
path traversal vulnerabilities. The note also references the `extract` and
`extractall` methods for comparison and suggests using `os.path.abspath` and
`os.path.commonpath` for safe filename resolution.
(cherry picked from commit a3990df6121880e8c67824a101bb1316de232898)
Co-authored-by: Affan Shaikhsurab
<51104750+affanshaikhsu...@users.noreply.github.com>
files:
M Doc/library/zipfile.rst
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst
index 5583c6b24be5c6..01f933386f3629 100644
--- a/Doc/library/zipfile.rst
+++ b/Doc/library/zipfile.rst
@@ -543,6 +543,14 @@ Path Objects
e.g. 'dir/file.txt', 'dir/', or ''. Defaults to the empty string,
indicating the root.
+ .. note::
+ The :class:`Path` class does not sanitize filenames within the ZIP
archive. Unlike
+ the :meth:`ZipFile.extract` and :meth:`ZipFile.extractall` methods, it
is the
+ caller's responsibility to validate or sanitize filenames to prevent
path traversal
+ vulnerabilities (e.g., filenames containing ".." or absolute paths).
When handling
+ untrusted archives, consider resolving filenames using
:func:`os.path.abspath`
+ and checking against the target directory with
:func:`os.path.commonpath`.
+
Path objects expose the following features of :mod:`pathlib.Path`
objects:
_______________________________________________
Python-checkins mailing list -- python-checkins@python.org
To unsubscribe send an email to python-checkins-le...@python.org
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: arch...@mail-archive.com
