Description

jaraco

opened on May 27, 2024

Issue body actions

In jaraco/zipp#117, I learned that the current implementation of is_symlink might have a security risk if a user is relying on it to ensure that a zipfile has no symlinks before using another tool to extract it.

zipp 3.19.0 adds an implementation for Path.is_symlink to alleviate this risk.

CPython should adopt this change as well, possibly as a security fix.

Linked PRs

• gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). #119591
• [3.13] gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (GH-119591) #119985
• [3.12] gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (GH-119591) #119988
• gh-119588: Update docs to reflect decision to include the change with Python 3.13 and not 3.12. #120043
• [3.13] gh-119588: Update docs to reflect decision to include the change with Python 3.13 and not 3.12. (GH-120043) #120046

Activity

1. jaraco

   added a commit that references this issue on May 27, 2024

   pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0).

   f9cf590
2. jaraco commented on May 27, 2024

   

   jaraco

   on May 27, 2024

   MemberAuthor

   More actions

   The is_symlink was added in Python 3.12 (#102018) (note the backports of that PR only included one bugfix), so this change can be backported to Python 3.12 as a bugfix (no need to flag as a security fix).
3. jaraco

   added a commit that references this issue on May 27, 2024

   pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0).

   48b69a0
4. jaraco

   added a commit that references this issue on Jun 3, 2024

   gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (#119591)

   42a34dd
5. miss-islington

   added a commit that references this issue on Jun 3, 2024

   pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…

   094c41e
6. mliezun

   added a commit that references this issue on Jun 3, 2024

   pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…

   578b6ce
7. jaraco

   added 3 commits that reference this issue on Jun 4, 2024

   [3.13] gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (G…

   34a6d89

   pythongh-119588: Update docs to reflect decision to include the chang…

   ddb3dbe

   gh-119588: Update docs to reflect decision to include the change with…

   4dcd91c
8. miss-islington

   added a commit that references this issue on Jun 4, 2024

   pythongh-119588: Update docs to reflect decision to include the chang…

   8589ca7
9. jaraco

   added a commit that references this issue on Jun 4, 2024

   [3.13] gh-119588: Update docs to reflect decision to include the chan…

   6725c78
10. barneygale

    added 2 commits that reference this issue on Jun 5, 2024

    pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…

    25d0a68

    pythongh-119588: Update docs to reflect decision to include the chang…

    d34608d
11. serhiy-storchaka

    added this to Zipfile issues 📦on Jun 27, 2024
12. estyxx

    added 2 commits that reference this issue on Jul 17, 2024

    pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…

    dd2c3f3

    pythongh-119588: Update docs to reflect decision to include the chang…

    200fce4
13. hugovk commented on Aug 8, 2024

    

    hugovk

    on Aug 8, 2024

    Member

    More actions

    Triage: closing because the PR has been merged, please re-open if still needed. Thanks!
14. hugovk

    closed this as completedon Aug 8, 2024
15. github-project-automation

    moved this to Done in Zipfile issues 📦on Aug 8, 2024

Issue actions