GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.13] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) (#161719) by vstinner · Pull Request #161726 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzip, tarfile and zipfile main functions now call _remove_sys_path0() to prevent shadowing stdlib modules from extracted files.

(cherry picked from commit e891a91)

(cherry picked from commit 8aa5d65)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@vstinner @gpshead
@ethanfurman @Eclips4
[3.14] pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipf…
4e1d94f
…ile CLI (python#161706) (python#161719)

pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (python#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.

(cherry picked from commit e891a91)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
(cherry picked from commit 8aa5d65)
@vstinner
vstinner requested review from ericsnowcurrently and ethanfurman as code owners November 10, 2026 00:53
@vstinner vstinner added the type-security A security issue label Nov 10, 2026
This was referenced Nov 10, 2026
[3.14] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706) #161719
Merged
[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705
Open
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 10, 2026
@read-the-docs-community

read-the-docs-community Bot commented Nov 10, 2026

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35771966 | 📁 Comparing 4e1d94f against main (e891a91)

  🔍 Preview build  

418 files changed · + 1 added · ± 369 modified · - 48 deleted

+ Added

  • library/asyncio-policy.html

± Modified

  • about.html
  • bugs.html
  • copyright.html
  • glossary.html
  • index.html
  • license.html
  • py-modindex.html
  • builtins/constants.html
  • builtins/exceptions.html
  • builtins/functions.html
  • and 359 more...

- Deleted

  • improve-page-nojs.html
  • improve-page.html
  • _static/tachyon-example-flamegraph.html
  • _static/tachyon-example-heatmap.html
  • builtins/threadsafety.html
  • builtins/time-complexity.html
  • c-api/extension-modules.html
  • c-api/interp-lifecycle.html
  • c-api/lifecycle.html
  • c-api/profiling.html
  • and 38 more...
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@vstinner

vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

CIFuzz / cpython3 (memory):

INFO: 3184 files found in /github/workspace/cifuzz-corpus/fuzz_struct_unpack
UnicodeEncodeError: 'ascii' codec can't encode character '\udcce' in position 0: ordinal not in range(128)

@StanFromIreland: Do you know the status of CIFuzz in the 3.13 branch? Is it still used/relevant? The code looks outdated, I suppose that these errors can just be ignored. Maybe we should even disable these CI in the 3.13 branch?

According to Modules/_xxtestfuzz/fuzzer.c, fuzz_struct_unpack() calls struct.unpack(). I downloaded the artifact file: it contains two bytes, 0xce and 0x00. On Python 3.13, I get:

$ ./python
>>> struct.unpack(b'\xce\x00', b'')
UnicodeEncodeError: 'ascii' codec can't encode character '\udcce' in position 0: ordinal not in range(128)

In the main branch, all ValueError are ignored (UnicodeEncodeError is a subclass of ValueError):

    /* Ignore any ValueError, these are triggered by non-ASCII format. */
    if (unpacked == NULL && PyErr_ExceptionMatches(PyExc_ValueError)) {
        PyErr_Clear();
    }

So I suppose that Modules/_xxtestfuzz/fuzzer.c is outdated in the 3.13 branch which no only accepts bug fixes.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@StanFromIreland

StanFromIreland commented Nov 10, 2026

Copy link
Copy Markdown
Member

I need to discuss with the fuzzer team, but as I've proposed before, I think we should rip it out for branches that aren't main. CC @sethmlarson

sethmlarson, vstinner, and hugovk reacted with thumbs up emoji
All reactions
  • 👍 3 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@vstinner

vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

I need to discuss with the fuzzer team, but as I've proposed before, I think we should rip it out for branches that aren't main. CC @sethmlarson

I would be fine with that.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@gpshead gpshead added the release-blocker label Nov 11, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Nov 11, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Nov 11, 2026
@StanFromIreland StanFromIreland mentioned this pull request Nov 11, 2026
[3.15] Remove CIFuzz GitHub Action #161812
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner
@ericsnowcurrently ericsnowcurrently Awaiting requested review from ericsnowcurrently ericsnowcurrently is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting core review release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@vstinner @StanFromIreland @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.