https://github.com/python/cpython/commit/e29cce5ea81f94de936521cada96f2ffd5d42df1
commit: e29cce5ea81f94de936521cada96f2ffd5d42df1
branch: main
author: Aman Prajapati <[email protected]>
committer: ethanfurman <[email protected]>
date: 2026-10-12T11:49:57-07:00
summary:
gh-156026: document tar filter link targets (GH-156056)
files:
M Doc/library/tarfile.rst
diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst
index f8a40bc94a3fef..b40c0f991594dc 100644
--- a/Doc/library/tarfile.rst
+++ b/Doc/library/tarfile.rst
@@ -1067,7 +1067,8 @@ can be:
* the string ``'tar'``: Honor most *tar*-specific features (i.e. features of
UNIX-like filesystems), but block features that are very likely to be
- surprising or malicious. See :func:`tar_filter` for details.
+ surprising or malicious. Note that this filter does not limit the targets of
+ symbolic links. See :func:`tar_filter` for details.
* the string ``'data'``: Ignore or block most features specific to UNIX-like
filesystems. Intended for extracting cross-platform data archives.
@@ -1135,6 +1136,17 @@ reused in custom filters:
Return the modified ``TarInfo`` member.
+ .. warning::
+ This filter does not check :attr:`TarInfo.linkname`. This means it does
+ not limit where a symbolic link member points. An absolute symbolic-link
+ target will remain absolute, and a relative target may resolve outside the
+ extraction destination. The destination path protection described above
+ concerns only where the archive member itself is written, not where a
+ symbolic link resolves. The stricter :func:`data_filter` rejects these
+ unsafe link targets, raising :class:`~tarfile.AbsoluteLinkError` for
+ absolute link targets or :class:`~tarfile.LinkOutsideDestinationError`
+ for link targets outside the destination.
+
.. versionchanged:: next
Filenames containing ``..`` components are now normalized.
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
