bpo-41316: Make tarfile follow specs for FNAME#21511
Merged
miss-islington merged 6 commits intopython:masterfrom Sep 7, 2020
ArtemSBulgakov:bpo-41316
Merged
bpo-41316: Make tarfile follow specs for FNAME#21511miss-islington merged 6 commits intopython:masterfrom ArtemSBulgakov:bpo-41316
miss-islington merged 6 commits intopython:masterfrom
ArtemSBulgakov:bpo-41316
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tarfile writes full path to FNAME field of GZIP format instead of just basename if user specified absolute path. Some archive viewers may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.
RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.
So tarfile must remove directory names from FNAME and write only basename of file.
https://bugs.python.org/issue41316
Automerge-Triggered-By: @jaraco