GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — [CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 · Issue #112887 · python/cpython Closed Labels stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue DescriptionBug reportBug description:From the docs https://docs.python.org/3.11/library/tarfile.html#tarfile.data_filter it sounds like setting errorlevel to 0 and having a filter should logged that the offending member was skipped and continue extraction. It looks like it actually logs the filter error and extracts the offending member. The below code shows the filtererror and the extraction. From the docs: When a filter refuses to extract a file, it will raise an appropriate exception, a subclass of FilterError. This will abort the extraction if TarFile.errorlevel is 1 or more. With errorlevel=0 the error will be logged and the member will be skipped, but extraction will continue. I was expecting it to tell me the file it skipped and not have any extraction with the given code. import tarfile with open('test.txt', 'w') as f: f.write('Hello') with tarfile.open('my_archive.tar', 'w:xz') as tar: tar.add('test.txt', arcname='../test.txt') with tarfile.open("my_archive.tar") as tar: tar.debug = True tar.errorlevel = 0 print(tar.errorlevel) tar.extractall(filter="data") CPython versions tested on:3.11 Operating systems tested on:macOS Linked PRsActivity
MetadataMetadataAssigneesLabelsstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue Projects
MilestoneRelationshipsDevelopmentIssue actions |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |