From 594f87e323936d9ba4c1f1ea27831ccee951bb80 Mon Sep 17 00:00:00 2001 From: Christopher Swenson Date: Fri, 22 Oct 2021 19:10:18 -0700 Subject: [PATCH 1/2] bpo-20749: Copy security warning to shutil * Copied warning from `tarfile.extractall()` to `shutil.unpack_archive`. --- Doc/library/shutil.rst | 7 +++++++ Misc/ACKS | 1 + .../next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst | 2 ++ 3 files changed, 10 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst diff --git a/Doc/library/shutil.rst b/Doc/library/shutil.rst index 22d6dba9e1a9c61..6a856c32a6c4e73 100644 --- a/Doc/library/shutil.rst +++ b/Doc/library/shutil.rst @@ -657,6 +657,13 @@ provided. They rely on the :mod:`zipfile` and :mod:`tarfile` modules. registered for that extension. In case none is found, a :exc:`ValueError` is raised. + .. warning:: + + Never extract archives from untrusted sources without prior inspection. + It is possible that files are created outside of *path*, e.g. members + that have absolute filenames starting with ``"/"`` or filenames with two + dots ``".."``. + .. audit-event:: shutil.unpack_archive filename,extract_dir,format shutil.unpack_archive .. versionchanged:: 3.7 diff --git a/Misc/ACKS b/Misc/ACKS index 23c92abb4d02a73..0b9230f4f7936d9 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -1727,6 +1727,7 @@ Andrew Svetlov Paul Swartz Dennis Sweeney Al Sweigart +Christopher Swenson Sviatoslav Sydorenko Thenault Sylvain Péter Szabó diff --git a/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst b/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst new file mode 100644 index 000000000000000..b62c6cca9524a8f --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst @@ -0,0 +1,2 @@ +Copied security warning from ``tarfile.extractall()`` to +``shutil.unpack_archive()`` From 7e08c90a9cea440560fd581ef523dee45a191a38 Mon Sep 17 00:00:00 2001 From: Christopher Swenson Date: Mon, 25 Oct 2021 11:28:34 -0700 Subject: [PATCH 2/2] Update Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thankss @FFY00 Co-authored-by: Filipe Laíns --- .../next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst b/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst index b62c6cca9524a8f..f1a9537a666195a 100644 --- a/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst +++ b/Misc/NEWS.d/next/Security/2021-10-22-19-07-53.bpo-20749.hi0GfC.rst @@ -1,2 +1,2 @@ -Copied security warning from ``tarfile.extractall()`` to -``shutil.unpack_archive()`` +Copied security warning from :func:`tarfile.extractall()` to +:func:`shutil.unpack_archive()`.