Skip to content

[3.11] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambv merged 8 commits into from
Jun 3, 2025
+1,017 −138
Merged

[3.11] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135068

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
371b4ea
[3.11] gh-135034: Normalize link targets in tarfile, add `os.path.rea…
ambv Jun 3, 2025
698a6d4
Fix test failure in test_tarfile, remove tests that aren't suitable for
Yhg1s Jun 3, 2025
3196554
Fix a few tests, and a glaring logic error in the posixpath backport.
Yhg1s Jun 3, 2025
8ab383f
Stop using :cve:, which doesn't work in 3.11 and earlier.
Yhg1s Jun 3, 2025
6d4d4d6
Fix test_tarfile (for not exporting LinkFallbackError) and remove the
Yhg1s Jun 3, 2025
630ffa3
Fix Windows test_ntpath failures.
Yhg1s Jun 3, 2025
28d8d22
Fix merge error in backport.
Yhg1s Jun 3, 2025
92a788a
Remove backport of a test that won't pass under 3.11.
Yhg1s Jun 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Stop using :cve:, which doesn't work in 3.11 and earlier.
  • Loading branch information
@Yhg1s
Yhg1s committed Jun 3, 2025
commit 8ab383f9fb42085bf552da6aeb4f5148677f6459
10 changes: 5 additions & 5 deletions Doc/whatsnew/3.11.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2798,25 +2798,25 @@ os.path
:data:`os.path.ALLOW_MISSING`.
If used, errors other than :exc:`FileNotFoundError` will be re-raised;
the resulting path can be missing but it will be free of symlinks.
(Contributed by Petr Viktorin for :cve:`2025-4517`.)
(Contributed by Petr Viktorin for CVE 2025-4517.)

tarfile
-------

* :func:`~tarfile.data_filter` now normalizes symbolic link targets in order to
avoid path traversal attacks.
(Contributed by Petr Viktorin in :gh:`127987` and :cve:`2025-4138`.)
(Contributed by Petr Viktorin in :gh:`127987` and CVE 2025-4138.)
* :func:`~tarfile.TarFile.extractall` now skips fixing up directory attributes
when a directory was removed or replaced by another kind of file.
(Contributed by Petr Viktorin in :gh:`127987` and :cve:`2024-12718`.)
(Contributed by Petr Viktorin in :gh:`127987` and CVE 2024-12718.)
* :func:`~tarfile.TarFile.extract` and :func:`~tarfile.TarFile.extractall`
now (re-)apply the extraction filter when substituting a link (hard or
symbolic) with a copy of another archive member, and when fixing up
directory attributes.
The former raises a new exception, :exc:`~tarfile.LinkFallbackError`.
(Contributed by Petr Viktorin for :cve:`2025-4330` and :cve:`2024-12718`.)
(Contributed by Petr Viktorin for CVE 2025-4330 and CVE 2024-12718.)
* :func:`~tarfile.TarFile.extract` and :func:`~tarfile.TarFile.extractall`
no longer extract rejected members when
:func:`~tarfile.TarFile.errorlevel` is zero.
(Contributed by Matt Prodani and Petr Viktorin in :gh:`112887`
and :cve:`2025-4435`.)
and CVE 2025-4435.)
2 changes: 1 addition & 1 deletion Misc/NEWS.d/next/Security/2025-06-02-11-32-23.gh-issue-135034.RLGjbp.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@ Fixes multiple issues that allowed ``tarfile`` extraction filters
(``filter="data"`` and ``filter="tar"``) to be bypassed using crafted
symlinks and hard links.

Addresses :cve:`2024-12718`, :cve:`2025-4138`, :cve:`2025-4330`, and :cve:`2025-4517`.
Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, and CVE 2025-4517.

Loading