GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-160097: Reject links replacing the destination in `tarfile.tar_filter` by StanFromIreland · Pull Request #160098 · python/cpython

Conversation

StanFromIreland commented Oct 21, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Issue: tarfile.tar_filter doesn't handle symlinks with empty names #160097

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland added 2 commits

October 19, 2026 20:53


          Reject links replacing the destination in tarfile.tar_filter

56b8673


          Update news entry!

607f0ab

StanFromIreland requested a review from encukou

October 21, 2026 19:00

StanFromIreland requested a review from ethanfurman as a code owner

October 21, 2026 19:00

StanFromIreland added needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14

bugs and security fixes

needs backport to 3.15 bugs and security fixes labels

Oct 21, 2026

bedevere-app Bot mentioned this pull request

Oct 21, 2026

tarfile.tar_filter doesn't handle symlinks with empty names #160097

Closed

bedevere-app Bot added the awaiting core review label

Oct 21, 2026

read-the-docs-community Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35307573 | 📁 Comparing 4090063 against main (4869640)

🔍 Preview build

2 files changed

± library/tarfile.html
± whatsnew/changelog.html

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Make the destination link check lexical

StanFromIreland commented

Oct 21, 2026

View reviewed changes

Comment thread

Lib/tarfile.py

		# would replace it with a (sym)link, redirecting the destination
		# for all subsequent members.
		if ((member.islnk() or member.issym())
		and os.path.normpath(name) == os.curdir):

StanFromIreland Oct 21, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The old check compared the member's real path against the real path of the destination directory, this was incorrect. For example, a link named x was rejected whenever an earlier x -> . symlink existed, even though extracting it only replaces that symlink (and never touches the destination directory).

CC @gps-head

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou reacted with thumbs up emoji

All reactions

👍 1 reaction

sethmlarson Oct 21, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @gpshead

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

StanFromIreland requested a review from sethmlarson

October 22, 2026 07:07

encukou approved these changes

Oct 22, 2026

View reviewed changes

encukou left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland reacted with heart emoji

All reactions

❤️ 1 reaction

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Oct 22, 2026

StanFromIreland merged commit e7e0b35 into python:main

Oct 22, 2026

60 checks passed

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland deleted the tarfile-tar-filt-fix branch

October 22, 2026 20:23

bedevere-app Bot removed the awaiting merge label

Oct 22, 2026

miss-islington-app Bot commented Oct 22, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Oct 22, 2026

StanFromIreland added a commit that referenced this pull request

Oct 22, 2026


          [3.14] gh-160097: Reject links replacing the destination in `tarfile.…

0901ad4

…tar_filter` (GH-160098) (#160340)

(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>

StanFromIreland added a commit that referenced this pull request

Oct 22, 2026


          [3.15] gh-160097: Reject links replacing the destination in `tarfile.…

c6ada40

…tar_filter` (GH-160098) (#160339)

(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>

koizumikento mentioned this pull request

Oct 24, 2026

Update certifi and pin Python security baseline koizumikento/ai-agents-with-adk#1

Merged

Yhg1s pushed a commit that referenced this pull request

Oct 25, 2026


          [3.12] gh-160097: Reject links replacing the destination in `tarfile.…

f4401da

…tar_filter` (GH-160098) (#160342)

gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098)
(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>

Yhg1s added a commit that referenced this pull request

Oct 25, 2026


          [3.13] gh-160097: Reject links replacing the destination in `tarfile.…

04d8fca

…tar_filter` (GH-160098) (#160341)

gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098)
(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: T. Wouters <[email protected]>

pablogsal pushed a commit that referenced this pull request

Oct 25, 2026


          [3.11] gh-160097: Reject links replacing the destination in `tarfile.…

bc93f8a

…tar_filter` (GH-160098) (#160343)

gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098)
(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-160097: Reject links replacing the destination in `ta…

81cf366

…rfile.tar_filter` (pythonGH-160098) (python#160343)

pythongh-160097: Reject links replacing the destination in `tarfile.tar_filter` (pythonGH-160098)
(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>
(cherry picked from commit bc93f8a)

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-160097: Reject links replacing the destination in `ta…

99755e5

…rfile.tar_filter` (pythonGH-160098) (python#160343)

pythongh-160097: Reject links replacing the destination in `tarfile.tar_filter` (pythonGH-160098)
(cherry picked from commit e7e0b35)

Co-authored-by: Stan Ulbrych <[email protected]>
(cherry picked from commit bc93f8a)
(cherry picked from commit f2435de)

gpshead mentioned this pull request

Oct 29, 2026

gh-160863: Restore tarfile data filter's resolved destination check gpshead/cpython#24

Draft

Reviewers

encukou

encukou approved these changes

ethanfurman

Awaiting requested review from ethanfurman

ethanfurman is a code owner

sethmlarson

Awaiting requested review from sethmlarson

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

StanFromIreland commented Oct 21, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

StanFromIreland Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

sethmlarson Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

encukou left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

StanFromIreland commented Oct 21, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

read-the-docs-community Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.