GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-151987: Pass filter_function to TarFile._extract_one() during .extract() by encukou · Pull Request #151988 · python/cpython

Conversation

encukou commented Jun 23, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Issue: Tarfile.extract doesn't fully respect the filter parameter #151987

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

sethmlarson and others added 6 commits

March 18, 2026 14:54


          Pass filter_function to TarFile._extract_one() during .extract()

b612154


          Use os_helper for temporary directory

5edbc2e


          Add test for filtering the hardlink targed


          Merge in the main branch

49f92a1


          Use helpers for tests

afc0bec


          Add blurb

b873e05

encukou requested a review from ethanfurman as a code owner

June 23, 2026 12:29

bedevere-app Bot mentioned this pull request

Jun 23, 2026

Tarfile.extract doesn't fully respect the filter parameter #151987

Closed

bedevere-app Bot added the awaiting core review label

Jun 23, 2026

encukou added needs backport to 3.13

only security fixes

needs backport to 3.14

bugs and security fixes

needs backport to 3.15 bugs and security fixes and removed awaiting core review labels

Jun 23, 2026


          Skip test if mocked functions are unavailable

c2831a9

encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label

Jun 24, 2026

bedevere-bot commented Jun 24, 2026

Copy link

Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit c2831a9 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151988%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label

Jun 24, 2026

StanFromIreland approved these changes

Jun 25, 2026

View reviewed changes

StanFromIreland left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Lib/test/test_tarfile.py

		@unittest.skipUnless(hasattr(os, 'geteuid'), "missing os.geteuid")
		@support.subTests('link_type', (tarfile.SYMTYPE, tarfile.LNKTYPE))
		def test_chown_links_on_extractall(self, link_type):
		with ArchiveMaker() as arc:

StanFromIreland Jun 25, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These could be refactored, but due to the nature of this PR I don't think we need to delay with such things.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou reacted with thumbs up emoji

All reactions

👍 1 reaction

Comment thread

Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst

StanFromIreland Jun 25, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

encukou Jun 29, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, if you think we should treat it as a security issue.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland Jun 29, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought that was what we decided by accepting python/cpython#GHSA-379m-ccvw-g66r. It does come out as low, so I don't have any opinions as to whether it needs an advisory (other than the news entry).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

encukou Jun 30, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, let's honor the decision then.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-app Bot added the awaiting merge label

Jun 25, 2026

encukou added 2 commits

June 29, 2026 14:22


          Merge in the main branch

3564aa5


          Move MEWS entry

797a048

StanFromIreland approved these changes

Jun 29, 2026

View reviewed changes

StanFromIreland left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou reacted with heart emoji

All reactions

❤️ 1 reaction

StanFromIreland added needs backport to 3.10 needs backport to 3.11

only security fixes

needs backport to 3.12 only security fixes labels

Jun 29, 2026

encukou merged commit 7ccdbab into python:main

Jun 29, 2026

104 of 106 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Jun 29, 2026

miss-islington-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou deleted the tarfile-refilter-extract branch

June 29, 2026 15:41

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152608 is a backport of this pull request to the 3.15 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label

Jun 29, 2026

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152609 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label

Jun 29, 2026

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152610 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Jun 29, 2026

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152611 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label

Jun 29, 2026

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152612 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Jun 29, 2026

bedevere-app Bot commented Jun 29, 2026

Copy link

Copy Markdown

GH-152613 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.10 label

Jun 29, 2026

StanFromIreland pushed a commit that referenced this pull request

Jun 29, 2026


          [3.15] gh-151987: Pass filter_function to TarFile._extract_one() …

7b57e8d

…during `.extract()` (GH-151988) (#152608)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

StanFromIreland pushed a commit that referenced this pull request

Jun 29, 2026


          [3.14] gh-151987: Pass filter_function to TarFile._extract_one() du…

5e0ef3f

…ring `.extract()` (GH-151988) (#152609)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

StanFromIreland pushed a commit that referenced this pull request

Jun 29, 2026


          [3.13] gh-151987: Pass filter_function to TarFile._extract_one() du…

eee3ddf

…ring `.extract()` (GH-151988) (#152610)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

pablogsal pushed a commit that referenced this pull request

Jul 4, 2026


          [3.11] gh-151987: Pass filter_function to TarFile._extract_one() duri…

d2b2f5e

…ng .extract() (GH-151988) (#152612)

gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

pablogsal pushed a commit that referenced this pull request

Jul 11, 2026


          [3.10] gh-151987: Pass filter_function to TarFile._extract_one() duri…

cf23b91

…ng .extract() (GH-151988) (#152613)

* gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

* Remove newer test helpers

3.11+ has more granular platform support, mostly for WASI.
Use the 3.10 idioms instead:

- @symlink_test is a no-op on non-WASI platforms
- can_chmod is approximated by "not win32" elsewhere in test_tarfile

---------

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

Yhg1s pushed a commit that referenced this pull request

Aug 4, 2026


          [3.12] gh-151987: Pass filter_function to TarFile._extract_one() duri…

…ng .extract() (GH-151988) (#152611)

gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

red-hat-konflux-kflux-prd-rh02 Bot mentioned this pull request

Oct 8, 2026

NO-ISSUE: chore(deps): Refresh RPM lockfiles [SECURITY] quay/quay#5602

Closed

1 task

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.10] pythongh-151987: Pass filter_function to TarFile._extract_one(…

328e33f

…) during .extract() (pythonGH-151988) (python#152613)

* pythongh-151987: Pass filter_function to TarFile._extract_one() during .extract() (pythonGH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>

* Remove newer test helpers

3.11+ has more granular platform support, mostly for WASI.
Use the 3.10 idioms instead:

- @symlink_test is a no-op on non-WASI platforms
- can_chmod is approximated by "not win32" elsewhere in test_tarfile

---------

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
(cherry picked from commit cf23b91)

Reviewers

StanFromIreland

StanFromIreland approved these changes

ethanfurman

Awaiting requested review from ethanfurman

ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

encukou commented Jun 23, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented Jun 24, 2026

Uh oh!

StanFromIreland left a comment

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Jun 25, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Jun 25, 2026

Choose a reason for hiding this comment

Uh oh!

encukou Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

encukou Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

bedevere-app Bot commented Jun 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

encukou commented Jun 23, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.