GeezerVison

…P files on Windows (GH-146591) (GH-149065)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <[email protected]>

…P files on Windows (GH-146591) (GH-149064)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <[email protected]>

Introduced in python#8295 alongside shutil.unpack_archive() as a helper that
created the parent directory of each extracted member.

Orphaned by pythongh-146581 (pythonGH-146591), the ZIP path-traversal fix, which
reworked _unpack_zipfile() to create directories inline and deleted the
last _ensure_directory(targetpath) call site in the same change.

Since then the private helper has had no caller: a word-boundary search
across Lib, Modules, Python, Objects and Include finds zero references
outside its own definition, and a GitHub code search finds no downstream
importers.

Introduced in python#8295 alongside shutil.unpack_archive() as a helper that
created the parent directory of each extracted member.

Orphaned by pythongh-146581 (pythonGH-146591), the ZIP path-traversal fix, which
reworked _unpack_zipfile() to create directories inline and deleted the
last _ensure_directory(targetpath) call site in the same change.

Since then the private helper has had no caller: a word-boundary search
across Lib, Modules, Python, Objects and Include finds zero references
outside its own definition, and a GitHub code search finds no downstream
importers.

No longer used after gh-146581 (GH-146591).

)

No longer used after pythongh-146581 (pythonGH-146591).

…P files on Windows (GH-146591) (#149066)

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <[email protected]>

…P files on Windows (GH-146591) (#149071)

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.

(cherry picked from commit fc829e8)

…P files on Windows (GH-146591) (GH-149071) (#155440)

[3.11] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149071)

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit 7ef7dd0)


(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <[email protected]>

…for ZIP files on Windows (pythonGH-146591) (pythonGH-149071) (python#155440)

[3.11] pythongh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (pythonGH-146591) (pythonGH-149071)

pythongh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (pythonGH-146591)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit 7ef7dd0)

(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <[email protected]>
(cherry picked from commit 1071290)