Description

sepastian

opened on Nov 6, 2023

Issue body actions

I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive.

This is right, one file inside the archive is named somefile..ipynb, with two dots, likely misspelled.

This leads to a problem, because unpack_archive will skip extracting this file here, because it assumes that the file contains relative path components. The file is missing quietly in the extracted archive.

While skipping the file is different from standard behavior, the assumption that a file with a path containing two dots would be a relative path is also wrong. A relative path component is identified by "../" instead.

I can am going to submit a PR.

Linked PRs

• gh-111791: delegating extraction to zipfile module's extractall() method  #111824

Activity

1. sepastian

   changed the title [-]Don't skip files containing '..'[/-] [+]shutil.unpack_archive skips false positives containing '..'[/+] on Nov 6, 2023
2. AlexWaygood

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Nov 6, 2023
3. sepastian

   changed the title [-]shutil.unpack_archive skips false positives containing '..'[/-] [+]shutil.unpack_archive skips false negatives containing '..'[/+] on Nov 7, 2023
4. sepastian

   added a commit that references this issue on Nov 7, 2023

   fixing python#111791: delegating extraction in shutil.unpack_archive …

   c8a6b24
5. d-walkama commented on Nov 7, 2023

   

   d-walkama

   on Nov 7, 2023

   More actions

   Hi @sepastian, I actually just ran into this bug today. Do you know if it only affects zip files? As a workaround, could I create a .gztar?

   Reacted by Sebastian Gassner
6. sepastian commented on Nov 7, 2023

   

   sepastian

   on Nov 7, 2023

   ContributorAuthor

   More actions

   Hi @d-walkama, I don't know, if using a tar file would fix the issue. Just give it a try.

   I have submitted a PR today, which fixes the issue. You could also wait for that to get merged.

   Or you could just use zipfile.extractll() instead and for the time being, which works as expected.
7. serhiy-storchaka

   added this to Zipfile issues 📦on Dec 16, 2023
8. sepastian commented on Dec 9, 2024

   

   sepastian

   on Dec 9, 2024

   ContributorAuthor

   More actions

   This is a bug in the standard library and it has been sitting here for a year now. What are the next steps, anything I can do to move this forward? Maybe @AlexWaygood knows what to do next?

   This is my first contribution to CPython, so I have no idea if there's anything I can do to make progress here. If there's anything, please let me know, I'm happy to contribute (more)...
9. someguynamedjosh commented on Aug 8, 2025

   

   someguynamedjosh

   on Aug 8, 2025

   More actions

   I humorously managed to run into this bug with a file that was not misspelled. This soundtrack contains a track titled "66-6 St.", and when the soundtrack is downloaded in its entirety, you then get a .zip archive where one of the files is called "07 - 66-6 St..flac". (For this use case though, it's easy enough to just use zipfile instead.)
10. sepastian commented on Aug 8, 2025

    

    sepastian

    on Aug 8, 2025

    ContributorAuthor

    More actions

    Thanks @someguynamedjosh !

    Any chance this can get merged into Python @AlexWaygood? This is a bug and the PR has been sitting around for years. Anything I can do to make it happen?
11. AlexWaygood commented on Aug 8, 2025

    

    AlexWaygood

    on Aug 8, 2025

    Member

    More actions

    I'm afraid I don't really know anything about the internals of the shutil module and haven't got much spare time for CPython development these days!

    You might find this page of the devguide helpful: https://devguide.python.org/getting-started/pull-request-lifecycle/#pull-request-lifecycle. You can also consider posting something on Discourse similar to this: https://discuss.python.org/t/request-for-merge-fix-http-cookies-module-to-support-obsolete-rfc-850-date-format/73944
12. picnixz

    added

    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

    on Aug 8, 2025
13. picnixz commented on Aug 8, 2025

    

    picnixz

    on Aug 8, 2025

    Member

    More actions

    I can see how .. inside the name is actually wrongly interpreted. However, considering this may changes an existing (wrong) behavior, I think it's better if we:

    • fix handling of .. in shutil.unpack_archive: we would still skip files that are absolute or relative (so with .startswith(('/', '../')), but we would not delegate to zipfile.
    • in a separate issue and only for the main branch, we could to zipfile. But before that, we will need a separate discussion, likely a DPO one.
14. serhiy-storchaka commented on May 18, 2026

    

    serhiy-storchaka

    on May 18, 2026

    Member

    More actions

    This was fixed in #146591.
15. serhiy-storchaka

    closed this as completedon May 18, 2026
16. github-project-automation

    moved this to Done in Zipfile issues 📦on May 18, 2026
17. StanFromIreland

    closed this as a duplicateof shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names #146581 on May 18, 2026

Issue actions