https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 commit: fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 branch: main author: Petr Viktorin <[email protected]> committer: encukou <[email protected]> date: 2026-09-11T14:19:35+02:00 summary:
gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) Co-authored-by: Stan Ulbrych <[email protected]> files: A Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst M Lib/tarfile.py M Lib/test/test_tarfile.py diff --git a/Lib/tarfile.py b/Lib/tarfile.py index 6e092f1dcee5e88..a4f9ce3311f6dad 100644 --- a/Lib/tarfile.py +++ b/Lib/tarfile.py @@ -2841,9 +2841,11 @@ def makelink_with_filter(self, tarinfo, targetpath, "makelink_with_filter: if filter_function is not None, " + "extraction_root must also not be None") try: - filter_function( + filtered = filter_function( unfiltered.replace(name=tarinfo.name, deep=False), extraction_root) + if filtered is None: + return filtered = filter_function(unfiltered, extraction_root) except _FILTER_ERRORS as cause: raise LinkFallbackError(tarinfo, unfiltered.name) from cause diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py index be5abfe211fb929..598179983a7cbc5 100644 --- a/Lib/test/test_tarfile.py +++ b/Lib/test/test_tarfile.py @@ -4621,9 +4621,15 @@ def test_sneaky_hardlink_fallback(self): for filter in 'tar', 'fully_trusted': with self.subTest(filter), self.check_context(arc.open(), filter): if not os_helper.can_symlink(): - self.expect_file("a/t/dummy") - self.expect_file("b/") - self.expect_file("c/") + if filter == 'tar': + self.expect_exception( + tarfile.LinkFallbackError, + "link 'boom' would be extracted as a copy of " + + "'c/escape', which was rejected") + else: + self.expect_file("a/t/dummy") + self.expect_file("b/") + self.expect_file("c/") else: self.expect_file("a/t/dummy") self.expect_file("b/") @@ -4820,6 +4826,25 @@ def testing_filter(member, path): if os_helper.can_chmod(): self.assertFalse(path.stat().st_mode & stat.S_IWUSR) + @symlink_test + def test_extract_filters_target_none(self): + # Test that when extract() falls back to extracting (rather than + # linking) a hardlink target, the member is skipped if the filter + # returns None. + with ArchiveMaker() as arc: + arc.add('a/b/s', symlink_to='../escape') + arc.add('q', hardlink_to='a/b/s') + def filter_unsafe_members(member, path): + try: + return tarfile.data_filter(member, path) + except tarfile.FilterError as error: + return None + with self.check_context(arc.open(), filter_unsafe_members): + if os_helper.can_symlink(): + self.expect_file('a/b/s', symlink_to='../escape') + else: + self.expect_file('a/b/') # symlink is not extracted + def test_link_fallback_normalizes(self): # Make sure hardlink fallbacks work for non-normalized paths for all # filters diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst new file mode 100644 index 000000000000000..ba27e47f734bfb1 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst @@ -0,0 +1,3 @@ +In :mod:`tarfile`, when extracting a link falls back to extracting a member +of the archive, skip the member when the filter function returns None when +called with the extracted member's name replaced with the link's. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
