GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-149486: tarfile.data_filter: validate written link target by encukou · Pull Request #149487 · python/cpython

Conversation

@encukou

@encukou encukou commented May 7, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: tarfile.data_filter doesn't handle symlinks with empty names #149486

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
gpshead and others added 3 commits May 4, 2026 19:14
@gpshead
tarfile: validate the link target that is actually written
575c024 
The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.
@encukou
Add issue to blurb
95a1b3a
@encukou
Merge in the main branch
3012f22
@encukou
encukou requested a review from ethanfurman as a code owner May 7, 2026 09:31
@bedevere-app bedevere-app Bot mentioned this pull request May 7, 2026
tarfile.data_filter doesn't handle symlinks with empty names #149486
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label May 7, 2026
@encukou encukou added needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes and removed awaiting core review labels May 7, 2026
gpshead
gpshead approved these changes May 7, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added the awaiting merge label May 7, 2026
@StanFromIreland StanFromIreland assigned StanFromIreland and unassigned StanFromIreland May 7, 2026
@StanFromIreland StanFromIreland added the needs backport to 3.15 bugs and security fixes label May 7, 2026
@encukou
encukou merged commit 5784119 into python:main May 8, 2026
69 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented May 8, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou
encukou deleted the tarfile-validate-written-link-target branch May 8, 2026 12:16
@bedevere-app bedevere-app Bot removed the awaiting merge label May 8, 2026
@bedevere-app

bedevere-app Bot commented May 8, 2026

Copy link
Copy Markdown

GH-149553 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label May 8, 2026
@bedevere-app

bedevere-app Bot commented May 8, 2026

Copy link
Copy Markdown

GH-149554 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 8, 2026
@bedevere-app

bedevere-app Bot commented May 8, 2026

Copy link
Copy Markdown

GH-149555 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label May 8, 2026
@bedevere-app

bedevere-app Bot commented May 8, 2026

Copy link
Copy Markdown

GH-149556 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label May 8, 2026
encukou pushed a commit that referenced this pull request May 11, 2026
@miss-islington @gpshead
[3.15] gh-149486: tarfile.data_filter: validate written link target (G…
5cf47a2 
…H-149487) (GH-149553)

gh-149486: tarfile.data_filter: validate written link target (GH-149487)

The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.

(cherry picked from commit 5784119)

Co-authored-by: Gregory P. Smith <[email protected]>
encukou added a commit that referenced this pull request May 11, 2026
@miss-islington @encukou @gpshead
[3.14] gh-149486: tarfile.data_filter: validate written link target (G…
74cca9a 
…H-149487) (GH-149554)

* gh-149486: tarfile.data_filter: validate written link target (GH-149487)

The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.

(Patch by Greg; Petr's just reviewing & merging.)
(cherry picked from commit 5784119)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
encukou added a commit that referenced this pull request May 11, 2026
@miss-islington @encukou @gpshead
[3.13] gh-149486: tarfile.data_filter: validate written link target (G…
0478bd8 
…H-149487) (GH-149555)

* gh-149486: tarfile.data_filter: validate written link target (GH-149487)

The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.

(Patch by Greg; Petr's just reviewing & merging.)
(cherry picked from commit 5784119)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-bot

bedevere-bot commented May 11, 2026

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Fedora Stable LTO 3.15 (tier-1) has failed when building commit 5cf47a2.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/2090/builds/16) and take a look at the build logs.
  4. Check if the failure is related to this commit (5cf47a2) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/2090/builds/16

Failed tests:

  • test.test_multiprocessing_fork.test_processes

Failed subtests:

  • test_interrupt - test.test_multiprocessing_fork.test_processes.WithProcessesTestProcess.test_interrupt

Summary of the results of the build (if available):

==

Click to see traceback logs 
Traceback (most recent call last):
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/contextlib.py", line 116, in inner
    return func(*args, **kwds)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 649, in test_interrupt
    exitcode = self._kill_process(multiprocessing.Process.interrupt)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/contextlib.py", line 116, in inner
    return func(*args, **kwds)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 630, in _kill_process
    self.assertEqual(join(), None)
                     ~~~~^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 303, in __call__
    return self.func(*args, **kwds)
           ~~~~~~~~~^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/process.py", line 156, in join
    res = self._popen.wait(timeout)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/popen_fork.py", line 44, in wait
    return self.poll(os.WNOHANG if timeout == 0.0 else 0)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/popen_fork.py", line 28, in poll
    pid, sts = os.waitpid(self.pid, flag)
               ~~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 626, in handler
    raise RuntimeError('join took too long: %s' % p)
RuntimeError: join took too long: <Process name='Process-157' pid=3262808 parent=3260155 started daemon>


Traceback (most recent call last):
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/contextlib.py", line 116, in inner
    return func(*args, **kwds)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 649, in test_interrupt
    exitcode = self._kill_process(multiprocessing.Process.interrupt)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/contextlib.py", line 116, in inner
    return func(*args, **kwds)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 630, in _kill_process
    self.assertEqual(join(), None)
                     ~~~~^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 303, in __call__
    return self.func(*args, **kwds)
           ~~~~~~~~~^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/process.py", line 156, in join
    res = self._popen.wait(timeout)
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/popen_fork.py", line 44, in wait
    return self.poll(os.WNOHANG if timeout == 0.0 else 0)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/multiprocessing/popen_fork.py", line 28, in poll
    pid, sts = os.waitpid(self.pid, flag)
               ~~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/home/buildbot-worker/cstratak-fedora-stable-x86_64/3.15.cstratak-fedora-stable-x86_64.lto/build/Lib/test/_test_multiprocessing.py", line 626, in handler
    raise RuntimeError('join took too long: %s' % p)
RuntimeError: join took too long: <Process name='Process-1' pid=3282745 parent=3282743 started daemon>
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Yhg1s pushed a commit that referenced this pull request May 18, 2026
@miss-islington @encukou @gpshead
[3.12] gh-149486: tarfile.data_filter: validate written link target (G…
0d28f5e 
…H-149487) (#149556)

* gh-149486: tarfile.data_filter: validate written link target (GH-149487)

The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.

(Patch by Greg; Petr's just reviewing & merging.)
(cherry picked from commit 5784119)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

* Move dotdot_resolves_early setting to setUpClass

---------

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@StanFromIreland

StanFromIreland commented Jun 3, 2026

Copy link
Copy Markdown
Member

Does this not need backporting to 3.11 and 3.10?
encukou and michaelbrunnbauer reacted with heart emoji
All reactions
  • ❤️ 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou encukou added needs backport to 3.10 needs backport to 3.11 only security fixes labels Jun 4, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 4, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jun 4, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jun 4, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 578411982c16f753f4893532510099ef665117da 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned encukou Jun 4, 2026
@bedevere-app

bedevere-app Bot commented Jun 4, 2026

Copy link
Copy Markdown

GH-150904 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jun 4, 2026
pablogsal pushed a commit that referenced this pull request Jul 4, 2026
@miss-islington @encukou @gpshead
[3.11] gh-149486: tarfile.data_filter: validate written link target (G…
10a13be 
…H-149487) (#150904)

* gh-149486: tarfile.data_filter: validate written link target (GH-149487)

The data filter rewrote linknames with normpath() but ran the
containment check against the un-normalised value, and computed a
symlink's directory before stripping trailing slashes.  Both let a
crafted archive create links pointing outside the destination.  Also
reject link members that resolve to the destination directory itself,
which could otherwise replace it with a symlink and redirect all
subsequent members.

(Patch by Greg; Petr's just reviewing & merging.)
(cherry picked from commit 5784119)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

* Move dotdot_resolves_early setting to setUpClass

---------

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Jul 6, 2026

Copy link
Copy Markdown

GH-153180 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Jul 6, 2026
pablogsal pushed a commit that referenced this pull request Jul 6, 2026
@StanFromIreland
[3.10] gh-149486: tarfile.data_filter: validate written link target (G…
c063191 
…H-149487) (#153180)
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request Oct 28, 2026
@StanFromIreland @icanhasmath
[3.10] pythongh-149486: tarfile.data_filter: validate written link ta…
b6f6db1 
…rget (pythonGH-149487) (python#153180)

(cherry picked from commit c063191)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@encukou encukou

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@encukou @bedevere-bot @StanFromIreland @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.