GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI by vstinner · Pull Request #161706 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Nov 9, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Remove sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzpi, tarfile and zipfile main functions now call _remove_sys_path0() to prevent shadowing stdlib modules from extracted files.
  • Issue: [security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@vstinner @gpshead
pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI
3b41ecb
Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzpi, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.

Co-authored-by: Gregory P. Smith <[email protected]>
@vstinner
vstinner requested review from FFY00, ericsnowcurrently and ethanfurman as code owners November 9, 2026 20:56
@vstinner vstinner added the type-security A security issue label Nov 9, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 9, 2026
[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705
Open
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 9, 2026
@read-the-docs-community

read-the-docs-community Bot commented Nov 9, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35770317 | 📁 Comparing a25df3f against main (ad126c9)

  🔍 Preview build  

4 files changed
± c-api/init_config.html
± library/sys.html
± using/cmdline.html
± whatsnew/changelog.html
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@vstinner
_remove_sys_path0() now modifies sys.path in-place
6882ff1
Don't create a new list object anymore.
sethmlarson
sethmlarson approved these changes Nov 9, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Nov 9, 2026
@vstinner vstinner added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 9, 2026
ethanfurman
ethanfurman reviewed Nov 9, 2026
View reviewed changes
Comment thread Lib/test/test_runpy.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

@ethanfurman
fix typo
ca98c1b
ethanfurman
ethanfurman approved these changes Nov 9, 2026
View reviewed changes
Eclips4
Eclips4 reviewed Nov 9, 2026
View reviewed changes
Comment thread Lib/runpy.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/runpy.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread Lib/runpy.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

vstinner and others added 3 commits November 9, 2026 23:03
@vstinner @Eclips4
Update Lib/runpy.py
feaffef
Co-authored-by: Kirill Podoprigora <[email protected]>
@vstinner @Eclips4
Update Lib/runpy.py
eb7d635
Co-authored-by: Kirill Podoprigora <[email protected]>
@vstinner
Do nothing is sys._path0 == sys._stdlib_dir
296c65e
Cleanup tests
@vstinner

vstinner commented Nov 9, 2026

Copy link
Copy Markdown
Member Author

@Eclips4: I updated runpy._remove_sys_path0() to do nothing if sys._path0 == sys._stdlib_dir. Removing sys._stdlib_dir from sys.path is pretty bad, it breaks gzip for example (see my comment above).

Eclips4 and sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Eclips4
Eclips4 approved these changes Nov 9, 2026
View reviewed changes
@vstinner
Fix test
59a8da4
Keep a copy of sys_path to make sure that it's unchanged.
@vstinner
vstinner enabled auto-merge (squash) November 9, 2026 22:38
@vstinner
test_remove_sys_path0_run_python() requires subprocess support
a25df3f
@vstinner
vstinner merged commit e891a91 into python:main Nov 9, 2026
57 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@vstinner
vstinner deleted the sys_path0 branch November 9, 2026 23:49
@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 9, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.14
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

GH-161717 is a backport of this pull request to the 3.15 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app miss-islington-app Bot assigned vstinner Nov 9, 2026
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 9, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app

miss-islington-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker e891a9117985888df3e5d48145cf07ddda098335 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161719 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 10, 2026
@vstinner vstinner removed needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Nov 10, 2026
@vstinner

vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

Merged. Thanks for useful reviews! I pushed a late fix: runpy._remove_sys_path0() no longer removes sys._path0 if it's equal to sys._stdlib_dir.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

vstinner added a commit that referenced this pull request Nov 10, 2026
@miss-islington @vstinner
@gpshead @ethanfurman @Eclips4
[3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (
673607e
GH-161706) (#161717)

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (GH-161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.
(cherry picked from commit e891a91)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
vstinner added a commit that referenced this pull request Nov 10, 2026
@vstinner @gpshead
@ethanfurman @Eclips4
[3.14] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (
8aa5d65
#161706) (#161719)

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.




(cherry picked from commit e891a91)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
This was referenced Nov 10, 2026
[3.13] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) (#161719) #161726
Open
[3.12] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161727
Open
[3.11] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI #161728
Open
orsenthil pushed a commit to orsenthil/cpython that referenced this pull request Nov 12, 2026
@vstinner @gpshead
@ethanfurman @Eclips4 @orsenthil
pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (…
c86d549
…python#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman ethanfurman approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes
@Eclips4 Eclips4 Eclips4 approved these changes
@ericsnowcurrently ericsnowcurrently Awaiting requested review from ericsnowcurrently ericsnowcurrently is a code owner
@FFY00 FFY00 Awaiting requested review from FFY00 FFY00 is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@vstinner vstinner

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@vstinner @ethanfurman @sethmlarson @Eclips4
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.