peter-toth opened a new pull request, #57040: URL: https://github.com/apache/spark/pull/57040
### What changes were proposed in this pull request? `install_spark()` in `python/pyspark/install.py` downloads a Spark release archive and extracts it by rewriting each tar member's name with `os.path.relpath(member.name, package_name + os.path.sep)` and calling `tar.extract(member, dest)`. `os.path.relpath` does not strip `..` segments, so a crafted archive member could resolve to a path outside `dest` (a "zip slip" / path traversal) when extracted. This change extracts the loop into a helper `_extract_tar` that validates each member's resolved destination stays within `dest` before extracting, raising `ValueError` otherwise. The behavior for legitimate archives is unchanged. ### Why are the changes needed? `install_spark()` runs at `pip install pyspark` time (when `PYSPARK_HADOOP_VERSION`/`PYSPARK_HIVE_VERSION` is set) and downloads from an Apache mirror or a user-supplied `PYSPARK_RELEASE_MIRROR`. Extracting archive members without a containment check means a member path containing `..` would be written outside the intended destination directory. Adding an explicit resolved-path check is a straightforward robustness improvement. The check is portable across all supported Python versions (the built-in `tarfile` extraction `filter='data'` is only available on 3.12+, while Spark supports 3.11+). ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? New unit test `test_extract_tar` in `python/pyspark/tests/test_install_spark.py` that (1) extracts a benign archive with the top-level package directory stripped, and (2) asserts a member whose path escapes the destination directory is rejected and nothing is written. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
