diff options
| author | Gregory P. Smith <greg@mad-scientist.com> | 2009-09-29 21:56:31 (GMT) |
|---|---|---|
| committer | Gregory P. Smith <greg@mad-scientist.com> | 2009-09-29 21:56:31 (GMT) |
| commit | 657024cd26bb52f19029289beacccfcdfa9d437e (patch) | |
| tree | 878ca8fc151a2ecffafc622b67c879767a3e99b5 | |
| parent | 209d4c3151df0affb96fafc6826d24fc68fc3a15 (diff) | |
| download | cpython-657024cd26bb52f19029289beacccfcdfa9d437e.zip cpython-657024cd26bb52f19029289beacccfcdfa9d437e.tar.gz cpython-657024cd26bb52f19029289beacccfcdfa9d437e.tar.bz2 | |
Mention issue6972 in extractall docs about overwriting things outside of
the supplied path.
| -rw-r--r-- | Doc/library/zipfile.rst | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst index ec357bb..0577f10 100644 --- a/Doc/library/zipfile.rst +++ b/Doc/library/zipfile.rst @@ -207,6 +207,13 @@ ZipFile Objects be a subset of the list returned by :meth:`namelist`. *pwd* is the password used for encrypted files. + .. warning:: + + Never extract archives from untrusted sources without prior inspection. + It is possible that files are created outside of *path*, e.g. members + that have absolute filenames starting with ``"/"`` or filenames with two + dots ``".."``. + .. versionadded:: 2.6 |