GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.12] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI by vstinner · Pull Request #161727 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member

gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzip, tarfile and zipfile main functions now call _remove_sys_path0() to prevent shadowing stdlib modules from extracted files.

Backport to 3.12: add test.support.make_clean_env().

(cherry picked from commit e891a91)

(cherry picked from commit 8aa5d65)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vstinner @gpshead
@ethanfurman @Eclips4
[3.14] pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipf…
b6b7c67 
…ile CLI (python#161706) (python#161719)

pythongh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (python#161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.

Backport to 3.12: add test.support.make_clean_env().

(cherry picked from commit e891a91)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Ethan Furman <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
(cherry picked from commit 8aa5d65)
@vstinner
vstinner requested a review from ethanfurman as a code owner November 10, 2026 00:59
@vstinner vstinner added the type-security A security issue label Nov 10, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 10, 2026
[security] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI [CVE-2026-115791] #161705
Open
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 10, 2026
@vstinner

vstinner commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

Tests / Thread sanitizer / Thread sanitizer (pull_request): Failing after 5m

test_large_content_length_truncated() of test_httpservers failed with BrokenPipeError: [Errno 32] Broken pipe. I saw this test failing on some builldbots on 3.11 - 3.13 branches. Anyway, it's unrelated to my change.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead gpshead added the release-blocker label Nov 11, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Nov 11, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Nov 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting core review release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@vstinner @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.