GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-122905: Sanitize names in zipfile.Path. by jaraco · Pull Request #122906 · python/cpython

Conversation

@jaraco

@jaraco jaraco commented Aug 11, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Closes #122905; Ported from zipp 3.19.1; ref jaraco/zipp#119.

  • Issue: Malformed payload can lead to infinite loops in zipfile.Path #122905

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@jaraco
pythongh-122905: Sanitize names in zipfile.Path.
1e15a83 
Closes python#122905; Ported from zipp 3.19.1; ref jaraco/zipp#119.
@bedevere-app bedevere-app Bot mentioned this pull request Aug 11, 2024
Malformed payload can lead to infinite loops in zipfile.Path #122905
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label Aug 11, 2024
@jaraco
Add blurb
11920ac
@jaraco jaraco added needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Aug 11, 2024
@jaraco jaraco mentioned this pull request Aug 11, 2024
gh-122903: Honor directories in zipfile.Path.glob. #122908
Merged
@jaraco

jaraco commented Aug 11, 2024

Copy link
Copy Markdown
Member Author

This behavior has been published in jaraco/zipp since 2024-05-31, so I'm confident it's stable.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@jaraco
jaraco merged commit 9cd0326 into python:main Aug 11, 2024
@miss-islington-app

miss-islington-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

Thanks @jaraco for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Aug 11, 2024
@jaraco
jaraco deleted the bugfix/122905-malformed-zipfile-path-inputs branch August 11, 2024 23:48
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Aug 11, 2024
@jaraco @miss-islington
pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)
d6402c8 
Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <[email protected]>
@bedevere-app

bedevere-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

GH-122922 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Aug 11, 2024
@jaraco @miss-islington
pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)
ee9f405 
Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <[email protected]>
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Aug 11, 2024
@bedevere-app

bedevere-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

GH-122923 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9cd03263100ddb1657826cc4a71470786cab3932 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Aug 11, 2024
@miss-islington-app miss-islington-app Bot assigned jaraco Aug 11, 2024
@miss-islington-app

miss-islington-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9cd03263100ddb1657826cc4a71470786cab3932 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9cd03263100ddb1657826cc4a71470786cab3932 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Aug 11, 2024

Copy link
Copy Markdown

Sorry, @jaraco, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9cd03263100ddb1657826cc4a71470786cab3932 3.8
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 12, 2024
@jaraco
pythongh-122905: Sanitize names in zipfile.Path. (python#122906)
0d480f2 
Ported from zipp 3.19.1; ref jaraco/zipp#119.

(cherry picked from commit 9cd0326)
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 12, 2024
@jaraco
[3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906
ed03fe9 
)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <[email protected]>
@bedevere-app

bedevere-app Bot commented Aug 12, 2024

Copy link
Copy Markdown

GH-122925 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Aug 12, 2024
@jaraco

jaraco commented Aug 12, 2024

Copy link
Copy Markdown
Member Author

I've proposed the backport to 3.11. I'm hoping to cherrypick that to 3.10 and earlier, assuming it's accepted, rather that cherry-picking the change in main and re-reconciling the conflicts.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jaraco pushed a commit that referenced this pull request Aug 12, 2024
@miss-islington
[3.13] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122922)
8c73489
jaraco pushed a commit that referenced this pull request Aug 12, 2024
@miss-islington
[3.12] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122923)
dcc5182
pablogsal pushed a commit that referenced this pull request Aug 19, 2024
@jaraco
[3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122925)
795f259 
* gh-122905: Sanitize names in zipfile.Path. (#122906)

Ported from zipp 3.19.1; ref jaraco/zipp#119.

(cherry picked from commit 9cd0326)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <[email protected]>
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 19, 2024
@jaraco
[3.10] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pytho…
d82745e 
…nGH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <[email protected]>
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 19, 2024
@jaraco
[3.9] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (python…
8973dbf 
…GH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <[email protected]>
@bedevere-app

bedevere-app Bot commented Aug 19, 2024

Copy link
Copy Markdown

GH-123161 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Aug 19, 2024
@bedevere-app

bedevere-app Bot commented Aug 19, 2024

Copy link
Copy Markdown

GH-123162 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Aug 19, 2024
@bedevere-app

bedevere-app Bot commented Aug 19, 2024

Copy link
Copy Markdown

GH-123160 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Aug 19, 2024
blhsing pushed a commit to blhsing/cpython that referenced this pull request Aug 22, 2024
@jaraco @blhsing
pythongh-122905: Sanitize names in zipfile.Path. (python#122906)
c0d9e10 
Ported from zipp 3.19.1; ref jaraco/zipp#119.
@jaraco

jaraco commented Aug 22, 2024

Copy link
Copy Markdown
Member Author

That's weird - all three backports (3.8, 3.9, 3.10) are failing on the macos runners, two of them with segmentation faults. I'm 99.9% certain these changes aren't directly implicated. I've restarted the runners to see if maybe that clears things up, but there seems to be some stability issues on those branches.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pablogsal pushed a commit that referenced this pull request Aug 22, 2024
@jaraco
[3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#123160)
e0264a6 
[3.10] [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (GH-122925)

* gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)
@obfusk obfusk mentioned this pull request Aug 23, 2024
zipfile.Path regression #123270
Closed
@obfusk

obfusk commented Aug 23, 2024

Copy link
Copy Markdown
Contributor

This introduced a regression: #123270.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Guddu786i
Guddu786i approved these changes Oct 4, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 4, 2024
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
[Security] Vulnerability found in Security vulnerability BIT-python-2024-8088 in package python habitat-sh/foundational-packages#73
Closed
@emontnemery emontnemery mentioned this pull request Jan 27, 2026
Add option to use frontend PR artifact to frontend integration home-assistant/core#161291
Merged
10 of 21 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@Guddu786i Guddu786i Guddu786i approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@jaraco jaraco

Labels

awaiting core review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Malformed payload can lead to infinite loops in zipfile.Path

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@jaraco @obfusk @Guddu786i
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.