diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2022-05-02 17:34:59 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-05-02 17:34:59 (GMT) |
| commit | bab4d0bb1695ec8e4d89efe14c843c5080d46735 (patch) | |
| tree | b49d44e214f208e6b717788387b16602d6946ad9 | |
| parent | 864058ba86d93eee9b6ed10b93bd8839a6131e44 (diff) | |
| download | cpython-bab4d0bb1695ec8e4d89efe14c843c5080d46735.zip cpython-bab4d0bb1695ec8e4d89efe14c843c5080d46735.tar.gz cpython-bab4d0bb1695ec8e4d89efe14c843c5080d46735.tar.bz2 | |
gh-91783: Document security considerations for shutil.unpack_archive (GH-91844)
(cherry picked from commit 4b297a9ffd4a1d420c1a8016f4ed2c7f1d298469)
Co-authored-by: Sam Ezeh <sam.z.ezeh@gmail.com>
| -rw-r--r-- | Doc/library/shutil.rst | 8 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Documentation/2022-04-23-00-22-54.gh-issue-91783.N09dRR.rst | 2 |
2 files changed, 9 insertions, 1 deletions
diff --git a/Doc/library/shutil.rst b/Doc/library/shutil.rst index 403df45..193c010 100644 --- a/Doc/library/shutil.rst +++ b/Doc/library/shutil.rst @@ -630,10 +630,16 @@ provided. They rely on the :mod:`zipfile` and :mod:`tarfile` modules. .. audit-event:: shutil.unpack_archive filename,extract_dir,format shutil.unpack_archive + .. warning:: + + Never extract archives from untrusted sources without prior inspection. + It is possible that files are created outside of the path specified in + the *extract_dir* argument, e.g. members that have absolute filenames + starting with "/" or filenames with two dots "..". + .. versionchanged:: 3.7 Accepts a :term:`path-like object` for *filename* and *extract_dir*. - .. function:: register_unpack_format(name, extensions, function[, extra_args[, description]]) Registers an unpack format. *name* is the name of the format and diff --git a/Misc/NEWS.d/next/Documentation/2022-04-23-00-22-54.gh-issue-91783.N09dRR.rst b/Misc/NEWS.d/next/Documentation/2022-04-23-00-22-54.gh-issue-91783.N09dRR.rst new file mode 100644 index 0000000..4d6be37 --- /dev/null +++ b/Misc/NEWS.d/next/Documentation/2022-04-23-00-22-54.gh-issue-91783.N09dRR.rst @@ -0,0 +1,2 @@ +Document security issues concerning the use of the function +:meth:`shutil.unpack_archive` |