GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) by jaraco · Pull Request #122925 · python/cpython

Conversation

@jaraco

@jaraco jaraco commented Aug 12, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: Malformed payload can lead to infinite loops in zipfile.Path #122905

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
jaraco added 2 commits August 11, 2024 20:21
@jaraco
pythongh-122905: Sanitize names in zipfile.Path. (python#122906)
0d480f2 
Ported from zipp 3.19.1; ref jaraco/zipp#119.

(cherry picked from commit 9cd0326)
@jaraco
[3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906
ed03fe9 
)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <[email protected]>
This was referenced Aug 12, 2024
gh-122905: Sanitize names in zipfile.Path. #122906
Merged
Malformed payload can lead to infinite loops in zipfile.Path #122905
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label Aug 12, 2024
@jaraco
jaraco requested a review from pablogsal August 12, 2024 00:25
@jaraco

jaraco commented Aug 12, 2024

Copy link
Copy Markdown
Member Author

@pablogsal I'm interested in your review to confirm that you agree this change addresses a security issue per the release policy.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pablogsal
pablogsal approved these changes Aug 19, 2024
View reviewed changes

@pablogsal pablogsal left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM approved!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Aug 19, 2024
@pablogsal
pablogsal merged commit 795f259 into python:3.11 Aug 19, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Aug 19, 2024
@jaraco
jaraco deleted the backport-9cd0326-3.11 branch August 19, 2024 23:37
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 19, 2024
@jaraco
[3.10] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pytho…
d82745e 
…nGH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <[email protected]>
@bedevere-app

bedevere-app Bot commented Aug 19, 2024

Copy link
Copy Markdown

GH-123160 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jaraco added a commit to jaraco/cpython that referenced this pull request Aug 19, 2024
@jaraco
[3.9] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (python…
8973dbf 
…GH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <[email protected]>
pablogsal pushed a commit that referenced this pull request Aug 22, 2024
@jaraco
[3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#123160)
e0264a6 
[3.10] [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (GH-122925)

* gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pablogsal pablogsal pablogsal approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@jaraco @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.