GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` by ambv · Pull Request #135037 · python/cpython

Conversation

@ambv

@ambv ambv commented Jun 2, 2025 •
edited by encukou
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.

[edit @encukou]: Also addresses CVE-2025-4435. Sorry for leaving that out of the commit messages.

Co-authored-by: Petr Viktorin [email protected]
Signed-off-by: Łukasz Langa [email protected]

  • Issue: Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") #135034

📚 Documentation preview 📚: https://cpython-previews--135037.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@ambv @encukou
pythongh-135034: Normalize link targets in tarfile, add `os.path.real…
0c16f5f 
…path(strict='allow_missing')`

Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.

Co-authored-by: Petr Viktorin <[email protected]>
Signed-off-by: Łukasz Langa <[email protected]>
@ambv
ambv requested a review from ethanfurman as a code owner June 2, 2025 16:24
@bedevere-app bedevere-app Bot added the awaiting core review label Jun 2, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Jun 2, 2025
Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") #135034
Closed
ambv and others added 2 commits June 2, 2025 18:30
@ambv
Fix lint
335921b
@sethmlarson
Add blurb
fcefa72
@serhiy-storchaka

serhiy-storchaka commented Jun 2, 2025

Copy link
Copy Markdown
Member

See also #71189.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ambv
Fix test_tarfile on WASI
9c275a7
@ambv
ambv force-pushed the gh-135034 branch from d25f924 to 9c275a7 Compare June 2, 2025 17:30
@ambv
Remove spurious line
b59eaaa
AA-Turner
AA-Turner reviewed Jun 2, 2025
View reviewed changes
Comment thread Lib/test/test_tarfile.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
ambv and others added 3 commits June 2, 2025 22:10
@ambv @AA-Turner
Fix invalid parent directory unwinding in test
fd5ba13 
Co-authored-by: Adam Turner <[email protected]>
@ambv
Make tests more chatty
aeebdc8
@ambv
Use a better skip
f5544e6
encukou
encukou reviewed Jun 2, 2025
View reviewed changes
Comment thread Lib/test/test_tarfile.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
encukou
encukou reviewed Jun 2, 2025
View reviewed changes
Comment thread Lib/test/test_ntpath.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@encukou

encukou commented Jun 2, 2025

Copy link
Copy Markdown
Member

See also #71189.

To align with this, there'd be a ntpath.ALLOW_MISSING singleton rather than an 'allow_missing' string.
That's possible, of course. It can catch typos. But I don't think it's worth having to import an extra name.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ambv and others added 2 commits June 3, 2025 00:31
@ambv
Work around Windows test failures
3c5ed15
@encukou
Add ERROR_ACCESS_DENIED
5af66c6
@encukou encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025
@bedevere-bot

bedevere-bot commented Jun 2, 2025

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit 5af66c6 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135037%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025
encukou and others added 7 commits June 3, 2025 01:14
@encukou @serhiy-storchaka
Switch to singleton
a124c42 
Co-authored-by: Serhiy Storchaka <[email protected]>
@encukou
Add ENAMETOOLONG to expected failures. And an extra subTest.
5bf4a48
@encukou
Discard more special files
3b54acd
@encukou
Use shorter names on Android
7ff96a2
@encukou
Fix docs warning
f845343
@ambv
Attempt to restore ntpath test
fd2013a
@ambv
Revert "Attempt to restore ntpath test"
f8f2786 
This reverts commit fd2013a.
@encukou encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 3, 2025
This was referenced Nov 2, 2026
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418 RADAR-base/radar-helm-charts#21636
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415579 RADAR-base/radar-helm-charts#21637
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415581 RADAR-base/radar-helm-charts#21638
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415856 RADAR-base/radar-helm-charts#21639
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415830 RADAR-base/radar-helm-charts#21640
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10409389 RADAR-base/radar-helm-charts#21649
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415372 RADAR-base/radar-helm-charts#21651
Open
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418 RADAR-base/radar-helm-charts#21654
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415581 RADAR-base/radar-helm-charts#21656
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415830 RADAR-base/radar-helm-charts#21658
Open
This was referenced Nov 9, 2026
Directory Traversal SNYK-RHEL9-PYTHON3-10409385 RADAR-base/radar-helm-charts#22115
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415394 RADAR-base/radar-helm-charts#22117
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10409385 RADAR-base/radar-helm-charts#22118
Open
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3-10415440 RADAR-base/radar-helm-charts#22119
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415394 RADAR-base/radar-helm-charts#22120
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415579 RADAR-base/radar-helm-charts#22121
Open
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3-10415440 RADAR-base/radar-helm-charts#22122
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415856 RADAR-base/radar-helm-charts#22123
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415579 RADAR-base/radar-helm-charts#22124
Open
Directory Traversal SNYK-RHEL9-PYTHON3-10415856 RADAR-base/radar-helm-charts#22126
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10409389 RADAR-base/radar-helm-charts#22133
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415372 RADAR-base/radar-helm-charts#22134
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10409389 RADAR-base/radar-helm-charts#22136
Open
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418 RADAR-base/radar-helm-charts#22137
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415372 RADAR-base/radar-helm-charts#22138
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415581 RADAR-base/radar-helm-charts#22139
Open
Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418 RADAR-base/radar-helm-charts#22140
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415830 RADAR-base/radar-helm-charts#22141
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415581 RADAR-base/radar-helm-charts#22142
Open
Directory Traversal SNYK-RHEL9-PYTHON3LIBS-10415830 RADAR-base/radar-helm-charts#22143
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou left review comments
@AA-Turner AA-Turner AA-Turner left review comments
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@Yhg1s Yhg1s

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@ambv @serhiy-storchaka @encukou @bedevere-bot @AA-Turner @Yhg1s @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.