https://github.com/python/cpython/commit/a6b4aa687cd9f8f95e3b940e6314ac8f2a85fbbb commit: a6b4aa687cd9f8f95e3b940e6314ac8f2a85fbbb branch: main author: Petr Viktorin <[email protected]> committer: ethanfurman <[email protected]> date: 2026-10-14T15:53:16-07:00 summary:
gh-156026: Add warning about link targets to tarfile.tar_filter (GH-159019) Co-authored-by: Ethan Furman <[email protected]> files: M Doc/library/tarfile.rst diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index f1c7dbbab40e79..1b2c328f9cad9f 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1137,17 +1137,13 @@ reused in custom filters: Return the modified ``TarInfo`` member. .. warning:: - This filter does not check :attr:`TarInfo.linkname`. This means it does - not limit where a symbolic link member points. An absolute symbolic-link - target will remain absolute, and a relative target may resolve outside the - extraction destination. The destination path protection described above - concerns only where the archive member itself is written, not where a - symbolic link resolves. The stricter :func:`data_filter` rejects these - unsafe link targets, raising :class:`~tarfile.AbsoluteLinkError` for - absolute link targets or :class:`~tarfile.LinkOutsideDestinationError` - for link targets outside the destination. - - .. versionchanged:: 3.16 + + This filter does not check link targets (:attr:`TarInfo.linkname`). + It allows benign cases (like links to ``/dev/null``), but it also allows + links (symbolic and hard) to arbitrary files on the filesystem, + potentially granting unintended access to these files. + + .. versionchanged:: next Filenames containing ``..`` components are now normalized. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
