Fix tarfile FilterError handling to skip member extraction

mattprodani · mattprodani · commit 3243699a8739 · 2023-12-01T15:13:17.000-05:00
In `tarfile` library, FilterError with error_level set to 0 correctly logged a debugging
message but did not properly skip extraction of a member. Updates filter
functions to return None when a FilterError is seen, as stated in docs.
diff --git a/Lib/tarfile.py b/Lib/tarfile.py
@@ -817,16 +817,26 @@ def fully_trusted_filter(member, dest_path):
     return member
 
 def tar_filter(member, dest_path):
-    new_attrs = _get_filtered_attrs(member, dest_path, False)
-    if new_attrs:
-        return member.replace(**new_attrs, deep=False)
-    return member
+    try:
+        new_attrs = _get_filtered_attrs(member, dest_path, False)
+        if new_attrs:
+            member = member.replace(**new_attrs, deep=False)
+    except FilterError:
+        member = None
+        raise
+    finally:
+        return member
 
 def data_filter(member, dest_path):
-    new_attrs = _get_filtered_attrs(member, dest_path, True)
-    if new_attrs:
-        return member.replace(**new_attrs, deep=False)
-    return member
+    try:
+        new_attrs = _get_filtered_attrs(member, dest_path, True)
+        if new_attrs:
+            member = member.replace(**new_attrs, deep=False)
+    except FilterError:
+        member = None
+        raise
+    finally:
+        return member
 
 _NAMED_FILTERS = {
     "fully_trusted": fully_trusted_filter,
