Skip to content

gh-146581: Update docs for dangerous filenames in ZIP files - #149994

Merged
serhiy-storchaka merged 2 commits into
python:mainfrom
serhiy-storchaka:unzip-docs-bad-filenames
May 19, 2026
Merged

gh-146581: Update docs for dangerous filenames in ZIP files#149994
serhiy-storchaka merged 2 commits into
python:mainfrom
serhiy-storchaka:unzip-docs-bad-filenames

Conversation

@serhiy-storchaka

@serhiy-storchakaserhiy-storchaka commented May 18, 2026•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@serhiy-storchakaserhiy-storchaka added docs Documentation in the Doc dir skip news needs backport to 3.13 bugs and security fixes labels May 18, 2026
@serhiy-storchakaserhiy-storchaka added needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels May 18, 2026
@bedevere-appbedevere-appBot mentioned this pull request May 18, 2026
Open
@read-the-docs-community

read-the-docs-communityBot commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #32743883 | 📁 Comparing cadce7a against main (bd6bf91)

🔍 Preview build

8 files changed · + 1 added · ± 7 modified

+Added

±Modified

StanFromIreland
StanFromIreland reviewed May 18, 2026
View reviewed changes
Comment threadDoc/library/shutil.rst Outdated
Comment threadDoc/library/zipfile.rst Outdated
Comment threadDoc/library/zipfile.rst Outdated
@serhiy-storchaka@StanFromIreland
Apply suggestions from code review
cadce7a
Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland
StanFromIreland approved these changes May 18, 2026
View reviewed changes

@StanFromIrelandStanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks Serhiy

@serhiy-storchakaserhiy-storchaka mentioned this pull request May 18, 2026
Closed
@serhiy-storchaka

serhiy-storchaka commented May 18, 2026

Copy link
Copy Markdown
MemberAuthor

This PR was inspired by @sepastian's PR #111824. I missed that the docs also need an update in the previous PR. filenames with two dots ".." is unclear -- it can be read as with the ".." component (like it should be) or as literally containing the ".." substring (like it was implemented in _unpack_zipfile). Also, filenames starting with "/" was not only absolute paths.

@StanFromIreland

StanFromIreland commented May 18, 2026

Copy link
Copy Markdown
Member

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <sebastian.gassner@gmail.com>.

@merwok

merwok commented May 19, 2026

Copy link
Copy Markdown
Member

Yes, and/or Misc/ACKS

@serhiy-storchaka
serhiy-storchaka merged commit ba0aca3 into python:mainMay 19, 2026
34 checks passed
@github-project-automationgithub-project-automationBot moved this from Todo to Done in Docs PRsMay 19, 2026
@miss-islington-app

miss-islington-appBot commented May 19, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@serhiy-storchaka
serhiy-storchaka deleted the unzip-docs-bad-filenames branch May 19, 2026 08:36
@bedevere-app

bedevere-appBot commented May 19, 2026

Copy link
Copy Markdown

GH-150064 is a backport of this pull request to the 3.15 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 19, 2026
@bedevere-app

bedevere-appBot commented May 19, 2026

Copy link
Copy Markdown

GH-150065 is a backport of this pull request to the 3.14 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.14 bugs and security fixes label May 19, 2026
@bedevere-app

bedevere-appBot commented May 19, 2026

Copy link
Copy Markdown

GH-150066 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.13 bugs and security fixes label May 19, 2026
@serhiy-storchaka

serhiy-storchaka commented May 19, 2026

Copy link
Copy Markdown
MemberAuthor

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <sebastian.gassner@gmail.com>.

Good idea. Although I only took idea that some changes were needed here. The changes themselves were different, and applied more wide.

serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington@serhiy-storchaka@sepastian
[3.14]gh-146581: Update docs for dangerous filenames in ZIP files (G…
8e13025
…H-149994) (GH-150065)
(cherry picked from commit ba0aca3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington@serhiy-storchaka@sepastian
[3.13]gh-146581: Update docs for dangerous filenames in ZIP files (G…
8ee6aff
…H-149994) (GH-150066)
(cherry picked from commit ba0aca3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington@serhiy-storchaka@sepastian
[3.15]gh-146581: Update docs for dangerous filenames in ZIP files (G…
65b2554
…H-149994) (GH-150064)
gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994)
(cherry picked from commit ba0aca3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIrelandStanFromIrelandStanFromIreland approved these changes
@giampaologiampaoloAwaiting requested review from giampaologiampaolo is a code owner

Assignees

No one assigned

Labels

docsDocumentation in the Doc dirskip news

Projects

Docs PRs
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@serhiy-storchaka@StanFromIreland@merwok