GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Tarfile.extract doesn't fully respect the filter parameter · Issue #151987 · python/cpython

Tarfile.extract doesn't fully respect the filter parameter #151987

New issue
Copy link
New issue
Copy link
Closed
Closed
Tarfile.extract doesn't fully respect the filter parameter#151987
Copy link
Assignees
encukou
Labels
3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Description

@encukou
encukou
opened on Jun 23, 2026
Issue body actions

Bug report

In the Tarfile.extract function, the filter parameter is not called properly when extracting a hardlink whose target is not present (and the file is extracted from the archive rather than linked).

Linked PRs

  • gh-151987: Pass filter_function to TarFile._extract_one() during .extract() #151988
  • [3.15] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152608
  • [3.14] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152609
  • [3.13] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152610
  • [3.12] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152611
  • [3.11] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152612
  • [3.10] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) #152613

Activity

Next
  1. encukou
    self-assigned this
    on Jun 23, 2026
  2. encukou
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Jun 23, 2026
  3. encukou
    added this to Tarfile issues 🗄️on Jun 23, 2026
  4. encukou
    added
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    on Jun 23, 2026
  5. StanFromIreland
    added
    type-securityA security issueA security issue
    3.11only security fixesonly security fixes
    3.10 (EOL)end of lifeend of life
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.16new features, bugs and security fixesnew features, bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Jun 23, 2026
  6. encukou
    added a commit that references this issue on Jun 29, 2026

    gh-151987: Pass filter_function to TarFile._extract_one() during .ext…

    7ccdbab
  7. StanFromIreland
    added 2 commits that reference this issue on Jun 29, 2026

    [3.15] gh-151987: Pass `filter_function` to `TarFile._extract_one()` …

    7b57e8d

    [3.14] gh-151987: Pass filter_function to `TarFile._extract_one()` du…

    5e0ef3f
  8. 7 remaining items

  9. Yhg1s
    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-151987: Pass filter_function to TarFile._extract_one() duri…

    0367912
  10. encukou
    closed this as completedon Aug 5, 2026
  11. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Aug 5, 2026
  12. arnout
    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    80251a0
  13. bmwiedemann
    added a commit that references this issue on Aug 17, 2026

    Update python313 to version 3.13.14 / rev 44 via SR 1371267

    b2e2336
  14. mcepl
    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    faf91be

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    e883ed1

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    2bdeb6d

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    7d8e598
  15. mcepl
    added 2 commits that reference this issue on Oct 1, 2026

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    6a3fa46

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    646508b
  16. ish-codes-magic
    added 2 commits that reference this issue on Oct 2, 2026

    docs(demo): the 75-second demo GIF (python/cpython#151987 escalating …

    53f4665

    docs(demo): the 75-second demo GIF (python/cpython#151987 escalating …

    fb110a4
  17. mcepl
    added a commit that references this issue on Oct 3, 2026

    [CVE-2026-4360] Pass filter_function to TarFile._extract_one() during…

    82e35be
  18. icanhasmath
    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-151987: Pass filter_function to TarFile._extract_one(…

    328e33f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @encukou
    encukou

Labels

3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Projects

  • Tarfile issues 🗄️
    Status
    Done
    Show more project fields

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.