Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address PEP 706 - Filter for tarfile.extractall #7294

Closed
pmisik opened this issue Dec 20, 2023 · 0 comments
Closed

Address PEP 706 - Filter for tarfile.extractall #7294

pmisik opened this issue Dec 20, 2023 · 0 comments

Comments

@pmisik
Copy link
Contributor

pmisik commented Dec 20, 2023

Given proposal improves security of tarfile extraction to help avoid CVE-2007-4559.

  • In Python 3.12-3.13, a DeprecationWarning is emitted and extraction uses fully_trusted filter.
  • In Python 3.14+, it will use the data filter.

It seems given proposal was backported also to older version of Python.

Reference: https://peps.python.org/pep-0706/
@p12tic p12tic closed this as completed in 180a490 Dec 20, 2023
p12tic pushed a commit to p12tic/buildbot that referenced this issue Dec 22, 2023
@pmisik @p12tic
Improve security of tarfile extraction addressed by PEP 706
9cd7624 
See PEP 706 - Filter for tarfile.extractall (https://peps.python.org/pep-0706/)

Python 3.12 report this as warning:
Python 3.14 will, by default, filter extracted tar archives and reject files or modify their metadata. Use the filter argument to control this behavior

Fixes buildbot#7294
p12tic pushed a commit to p12tic/buildbot that referenced this issue Dec 22, 2023
@pmisik @p12tic
Improve security of tarfile extraction addressed by PEP 706
dc752be 
See PEP 706 - Filter for tarfile.extractall (https://peps.python.org/pep-0706/)

Python 3.12 report this as warning:
Python 3.14 will, by default, filter extracted tar archives and reject files or modify their metadata. Use the filter argument to control this behavior

Fixes buildbot#7294
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@pmisik