Issue #2004: Use mode 0700 for temporary directories and default

permissions for missing directories.

(will backport to 2.5)

2 files changed, 12 insertions, 9 deletions

diff --git a/Lib/tarfile.py b/Lib/tarfile.py
index 7143f0b..92fdb7b 100644
--- a/Lib/tarfile.py
+++ b/Lib/tarfile.py
@@ -2021,15 +2021,11 @@ class TarFile(object):
 
         for tarinfo in members:
             if tarinfo.isdir():
-                # Extract directory with a safe mode, so that
-                # all files below can be extracted as well.
-                try:
-                    os.makedirs(os.path.join(path, tarinfo.name), 0700)
-                except EnvironmentError:
-                    pass
+                # Extract directories with a safe mode.
                 directories.append(tarinfo)
-            else:
-                self.extract(tarinfo, path)
+                tarinfo = copy.copy(tarinfo)
+                tarinfo.mode = 0700
+            self.extract(tarinfo, path)
 
         # Reverse sort directories.
         directories.sort(lambda a, b: cmp(a.name, b.name))
@@ -2134,6 +2130,8 @@ class TarFile(object):
         # Create all upper directories.
         upperdirs = os.path.dirname(targetpath)
         if upperdirs and not os.path.exists(upperdirs):
+            # Create directories that are not part of the archive with
+            # default permissions.
             os.makedirs(upperdirs)
 
         if tarinfo.islnk() or tarinfo.issym():
@@ -2170,7 +2168,9 @@ class TarFile(object):
         """Make a directory called targetpath.
         """
         try:
-            os.mkdir(targetpath)
+            # Use a safe mode for the directory, the real mode is set
+            # later in _extract_member().
+            os.mkdir(targetpath, 0700)
         except EnvironmentError, e:
             if e.errno != errno.EEXIST:
                 raise
diff --git a/Misc/NEWS b/Misc/NEWS
index 8a4b449..cf07233 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -388,6 +388,9 @@ Core and builtins
 Library
 -------
 
+- #2004: tarfile.py: Use mode 0700 for temporary directories and default
+  permissions for missing directories.
+
 - #175006: The debugger used to skip the condition of a "while" statement
   after the first iteration. Now it correctly steps on the expression, and
   breakpoints on the "while" statement are honored on each loop.