GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-146581: Update docs for dangerous filenames in ZIP files by serhiy-storchaka · Pull Request #149994 · python/cpython

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented May 18, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names #146581

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka
pythongh-146581: Update docs for dangerous filenames in ZIP files
92d653a
@serhiy-storchaka
serhiy-storchaka requested a review from giampaolo as a code owner May 18, 2026 14:07
@serhiy-storchaka serhiy-storchaka added docs Documentation in the Doc dir skip news needs backport to 3.13 only security fixes labels May 18, 2026
@github-project-automation github-project-automation Bot added this to Docs PRs May 18, 2026
@serhiy-storchaka serhiy-storchaka added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels May 18, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Docs PRs May 18, 2026
@bedevere-app bedevere-app Bot mentioned this pull request May 18, 2026
shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names #146581
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label May 18, 2026
@read-the-docs-community

read-the-docs-community Bot commented May 18, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #32743883 | 📁 Comparing cadce7a against main (bd6bf91)

  🔍 Preview build  

8 files changed · + 1 added · ± 7 modified

+ Added

  • deprecations/pending-removal-in-3.21.html

± Modified

  • deprecations/index.html
  • library/os.html
  • library/shutil.html
  • library/ssl.html
  • library/zipfile.html
  • whatsnew/3.16.html
  • whatsnew/changelog.html
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
StanFromIreland
StanFromIreland reviewed May 18, 2026
View reviewed changes
Comment thread Doc/library/shutil.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Doc/library/zipfile.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Doc/library/zipfile.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka @StanFromIreland
Apply suggestions from code review
cadce7a 
Co-authored-by: Stan Ulbrych <[email protected]>
StanFromIreland
StanFromIreland approved these changes May 18, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks Serhiy

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels May 18, 2026
@serhiy-storchaka serhiy-storchaka mentioned this pull request May 18, 2026
gh-111791: delegating extraction to zipfile module's extractall() method #111824
Closed
@serhiy-storchaka

serhiy-storchaka commented May 18, 2026

Copy link
Copy Markdown
Member Author

This PR was inspired by @sepastian's PR #111824. I missed that the docs also need an update in the previous PR. filenames with two dots ".." is unclear -- it can be read as with the ".." component (like it should be) or as literally containing the ".." substring (like it was implemented in _unpack_zipfile). Also, filenames starting with "/" was not only absolute paths.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@StanFromIreland

StanFromIreland commented May 18, 2026

Copy link
Copy Markdown
Member

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <[email protected]>.
serhiy-storchaka reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@merwok

merwok commented May 19, 2026

Copy link
Copy Markdown
Member

Yes, and/or Misc/ACKS
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
serhiy-storchaka merged commit ba0aca3 into python:main May 19, 2026
34 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from Todo to Done in Docs PRs May 19, 2026
@miss-islington-app

miss-islington-app Bot commented May 19, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label May 19, 2026
@serhiy-storchaka
serhiy-storchaka deleted the unzip-docs-bad-filenames branch May 19, 2026 08:36
@bedevere-app

bedevere-app Bot commented May 19, 2026

Copy link
Copy Markdown

GH-150064 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label May 19, 2026
@bedevere-app

bedevere-app Bot commented May 19, 2026

Copy link
Copy Markdown

GH-150065 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 19, 2026
@bedevere-app

bedevere-app Bot commented May 19, 2026

Copy link
Copy Markdown

GH-150066 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label May 19, 2026
@serhiy-storchaka

serhiy-storchaka commented May 19, 2026

Copy link
Copy Markdown
Member Author

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <[email protected]>.

Good idea. Although I only took idea that some changes were needed here. The changes themselves were different, and applied more wide.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka @sepastian
[3.14] gh-146581: Update docs for dangerous filenames in ZIP files (G…
8e13025 
…H-149994) (GH-150065)

(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: Sebastian Gassner <[email protected]>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka @sepastian
[3.13] gh-146581: Update docs for dangerous filenames in ZIP files (G…
8ee6aff 
…H-149994) (GH-150066)

(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: Sebastian Gassner <[email protected]>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka @sepastian
[3.15] gh-146581: Update docs for dangerous filenames in ZIP files (G…
65b2554 
…H-149994) (GH-150064)

gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994)
(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: Sebastian Gassner <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes
@giampaolo giampaolo Awaiting requested review from giampaolo giampaolo is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

docs Documentation in the Doc dir skip news

Projects

Docs PRs
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@serhiy-storchaka @StanFromIreland @merwok
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.