Skip to content

gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') - #135037

Merged
Yhg1s merged 20 commits into
python:mainfrom
ambv:gh-135034
Jun 3, 2025
Merged

gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing')#135037
Yhg1s merged 20 commits into
python:mainfrom
ambv:gh-135034

Conversation

@ambv

@ambvambv commented Jun 2, 2025•
edited by encukou
Loading

Copy link
Copy Markdown
Contributor

Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.

[edit @encukou]: Also addresses CVE-2025-4435. Sorry for leaving that out of the commit messages.

Co-authored-by: Petr Viktorin encukou@gmail.com
Signed-off-by: Łukasz Langa lukasz@langa.pl

📚 Documentation preview 📚: https://cpython-previews--135037.org.readthedocs.build/

@ambv@encukou
pythongh-135034: Normalize link targets in tarfile, add `os.path.real…
0c16f5f
…path(strict='allow_missing')`
Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Signed-off-by: Łukasz Langa <lukasz@langa.pl>
@ambv
ambv requested a review from ethanfurman as a code ownerJune 2, 2025 16:24
@bedevere-appbedevere-appBot mentioned this pull request Jun 2, 2025
Closed
@serhiy-storchaka

serhiy-storchaka commented Jun 2, 2025

Copy link
Copy Markdown
Member

See also #71189.

AA-Turner
AA-Turner reviewed Jun 2, 2025
View reviewed changes
Comment threadLib/test/test_tarfile.py Outdated
ambvand others added 3 commits June 2, 2025 22:10
@ambv@AA-Turner
Fix invalid parent directory unwinding in test
fd5ba13
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
@ambv
Make tests more chatty
aeebdc8
@ambv
Use a better skip
f5544e6
encukou
encukou reviewed Jun 2, 2025
View reviewed changes
Comment threadLib/test/test_tarfile.py Outdated
encukou
encukou reviewed Jun 2, 2025
View reviewed changes
Comment threadLib/test/test_ntpath.py Outdated
@encukou

encukou commented Jun 2, 2025

Copy link
Copy Markdown
Member

See also #71189.

To align with this, there'd be a ntpath.ALLOW_MISSING singleton rather than an 'allow_missing' string.
That's possible, of course. It can catch typos. But I don't think it's worth having to import an extra name.

@encukouencukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025
@bedevere-bot

bedevere-bot commented Jun 2, 2025

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit 5af66c6 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135037%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-botbedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025
@encukouencukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 3, 2025
This was referenced Jul 27, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@LEEKIYOON-SECLEEKIYOON-SEC mentioned this pull request Jul 27, 2026
Open
This was referenced Aug 3, 2026
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukouencukouencukou left review comments
@AA-TurnerAA-TurnerAA-Turner left review comments
@ethanfurmanethanfurmanAwaiting requested review from ethanfurmanethanfurman is a code owner

Assignees

@Yhg1sYhg1s

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@ambv@serhiy-storchaka@encukou@bedevere-bot@AA-Turner@Yhg1s@sethmlarson