GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-161323: Refuse drive-relative paths in tarfile extraction filters by gpshead · Pull Request #161334 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Nov 4, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

On Windows, os.path.join() does not put a name such as 'C:foo' below a destination that has no drive, so the 'tar' and 'data' filters now refuse names and link targets with a drive, after normalization.

  • Issue: tarfile: Windows same-drive drive-relative symlink not caught by data filter #161323

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
gpshead and others added 3 commits November 4, 2026 17:26
@gpshead
pythongh-161323: Refuse drive-relative paths in tarfile extraction fi…
b7444fc 
…lters

On Windows, os.path.join() does not put a name such as 'C:foo' below a
destination that has no drive, so the 'tar' and 'data' filters now refuse
names and link targets with a drive, after normalization.

ANT-2026-RSL1F4AT
@gpshead @encukou
docs simplification
683d174 
Co-authored-by: Petr Viktorin <[email protected]>
@gpshead
mention the cve number in the news entry since we have one.
18550d7
@gpshead
gpshead requested a review from ethanfurman as a code owner November 4, 2026 17:28
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 4, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 4, 2026
tarfile: Windows same-drive drive-relative symlink not caught by data filter #161323
Open
@gpshead gpshead added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes and removed awaiting core review labels Nov 4, 2026
@gpshead
gpshead requested a review from encukou November 4, 2026 17:28
@gpshead gpshead self-assigned this Nov 4, 2026
@gpshead
rename the NEWS file with issue number
8f0e071
ethanfurman
ethanfurman approved these changes Nov 4, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added the awaiting merge label Nov 4, 2026
@read-the-docs-community

read-the-docs-community Bot commented Nov 4, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35651939 | 📁 Comparing 36366e4 against main (1dd8e71)

  🔍 Preview build  

2 files changed
± library/tarfile.html
± whatsnew/changelog.html
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead
Merge branch 'main' into scanfix-tarfile-rsl1f4at
36366e4
@gpshead
gpshead merged commit e4c751b into python:main Nov 4, 2026
56 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 4, 2026
@gpshead
gpshead deleted the scanfix-tarfile-rsl1f4at branch November 4, 2026 21:24
@bedevere-app

bedevere-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

GH-161355 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 4, 2026
@bedevere-app

bedevere-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

GH-161356 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 4, 2026
@bedevere-app

bedevere-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

GH-161357 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Nov 4, 2026
@bedevere-app

bedevere-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

GH-161358 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Nov 4, 2026
@bedevere-app

bedevere-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

GH-161359 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Nov 4, 2026
gpshead added a commit that referenced this pull request Nov 4, 2026
@miss-islington @gpshead @encukou
[3.14] gh-161323: Refuse drive-relative paths in tarfile extraction f…
6fea59a 
…ilters (GH-161334) (#161356)

gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334)

* gh-161323: Refuse drive-relative paths in tarfile extraction filters

On Windows, os.path.join() does not put a name such as 'C:foo' below a
destination that has no drive, so the 'tar' and 'data' filters now refuse
names and link targets with a drive, after normalization.
Fixes CVE-2026-107784.

reported by Girish Konda

ANT-2026-RSL1F4AT
(cherry picked from commit e4c751b)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
gpshead added a commit that referenced this pull request Nov 4, 2026
@miss-islington @gpshead @encukou
[3.15] gh-161323: Refuse drive-relative paths in tarfile extraction f…
6ac089b 
…ilters (GH-161334) (#161355)

gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334)

* gh-161323: Refuse drive-relative paths in tarfile extraction filters

On Windows, os.path.join() does not put a name such as 'C:foo' below a
destination that has no drive, so the 'tar' and 'data' filters now refuse
names and link targets with a drive, after normalization.
Fixes CVE-2026-107784.

reported by Girish Konda

ANT-2026-RSL1F4AT
(cherry picked from commit e4c751b)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
StanFromIreland
StanFromIreland reviewed Nov 7, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-10-22-08-07-52.gh-issue-161323.q7Drv2.rst

@StanFromIreland StanFromIreland Nov 7, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we please record the CVE metadata in the standard format, rather than in the prose?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@gpshead gpshead Nov 7, 2026

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where do we describe what form should be used?

Our docs compilation accepted the :cve: ReST tag so I assumed that counted. is that not considered "the standard format"? it appears elsewhere in our docs.

can we make forms we don't want fail to pass CI? prevention is the best medicine.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@StanFromIreland StanFromIreland Nov 7, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant the:

.. cve: xxx

at the top of the file. That way it’s rendered beside the issue number in the changelog.

It would be a little hard to verify in the CI, there may be false positives…

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland left review comments
@ethanfurman ethanfurman ethanfurman approved these changes
@encukou encukou Awaiting requested review from encukou

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@gpshead @ethanfurman @StanFromIreland
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.