Skip to content

[3.10] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambv merged 13 commits into from
Jun 3, 2025
+944 −134
Merged

[3.10] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135070

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
4d959a0
[3.10] gh-135034: Normalize link targets in tarfile, add `os.path.rea…
ambv Jun 3, 2025
7c3e0dd
Drop the use of :cve:, which isn't supported in 3.11 and earlier.
Yhg1s Jun 3, 2025
9a46249
Merge branch '3.10' into backport-371b4ea-3.10
Yhg1s Jun 3, 2025
4afe368
Merge branch '3.10' into backport-371b4ea-3.10
Yhg1s Jun 3, 2025
aa526c0
Undo faulty merge.
Yhg1s Jun 3, 2025
6b6a77a
Fix test_tarfile (for not exporting LinkFallbackError) and remove the
Yhg1s Jun 3, 2025
0aaaeaa
Fix Windows test_ntpath failures.
Yhg1s Jun 3, 2025
05d7906
Fix merge error in backport.
Yhg1s Jun 3, 2025
ad7b73d
Remove backported tests that won't pass in 3.10 and earlier for reasons
Yhg1s Jun 3, 2025
bf6b637
Fix merge error.
Yhg1s Jun 3, 2025
dff62a1
Work around Path.glob() failure in 3.10
encukou Jun 3, 2025
720038b
Complete the backport of ALLOW_MISSING
encukou Jun 3, 2025
bacf333
Remove tests for WASI
encukou Jun 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Work around Path.glob() failure in 3.10
  • Loading branch information
@encukou
encukou committed Jun 3, 2025
commit dff62a1ede34f99ad342125a814f6fd6bba05981
11 changes: 8 additions & 3 deletions Lib/test/test_tarfile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3338,7 +3338,7 @@ class TestExtractionFilters(unittest.TestCase):
destdir = outerdir / 'dest'

@contextmanager
def check_context(self, tar, filter, *, check_flag=True):
def check_context(self, tar, filter, *, check_flag=True, ignored_trees=()):
"""Extracts `tar` to `self.destdir` and allows checking the result

If an error occurs, it must be checked using `expect_exception`
Expand All @@ -3351,6 +3351,10 @@ def check_context(self, tar, filter, *, check_flag=True):
A file called 'flag' is made in outerdir (i.e. outside destdir)
before extraction; it should not be altered nor should its contents
be read/copied.

*ignored_trees* is a set of directories to remove (including their
contents) right after the archive is extracted. It is a workaround
for Path.glob() failing to get all files in Python 3.10 and below.
"""
with os_helper.temp_dir(self.outerdir):
flag_path = self.outerdir / 'flag'
Expand All @@ -3362,6 +3366,8 @@ def check_context(self, tar, filter, *, check_flag=True):
self.reraise_exception = True
self.expected_paths = set()
else:
for ignored_tree in ignored_trees:
os_helper.rmtree((self.destdir / ignored_tree).resolve())
self.raised_exception = None
self.reraise_exception = False
self.expected_paths = set(self.outerdir.glob('**/*'))
Expand Down Expand Up @@ -3573,15 +3579,14 @@ def test_realpath_limit_attack(self):

with (self.subTest('fully_trusted'),
self.check_context(arc.open(), filter='fully_trusted',
check_flag=False)):
check_flag=False, ignored_trees={component})):
if sys.platform == 'win32':
self.expect_exception((FileNotFoundError, FileExistsError))
elif self.raised_exception:
# Cannot symlink/hardlink: tarfile falls back to getmember()
self.expect_exception(KeyError)
# Otherwise, this block should never enter.
else:
self.expect_any_tree(component)
self.expect_file('flaglink', content='overwrite')
self.expect_file('../newfile', content='new')
self.expect_file('escape', type=tarfile.SYMTYPE)
Expand Down