summaryrefslogtreecommitdiffstats
path: root/Doc
diff options
context:
space:
mode:
authorGregory P. Smith <greg@krypto.org>2013-02-01 19:31:31 (GMT)
committerGregory P. Smith <greg@krypto.org>2013-02-01 19:31:31 (GMT)
commit193e1be72d2f9bb45e054b38dd9ed1090c45f3bf (patch)
treeed26dbea67939a7a01ea3ee20190285d97fb7645 /Doc
parent0ecd30b4af4f5bd3c9e884a608e0a256ffe8f5fa (diff)
parentb47acbf46abd425f69dcc03e9b4f0c7f7c321ac2 (diff)
downloadcpython-193e1be72d2f9bb45e054b38dd9ed1090c45f3bf.zip
cpython-193e1be72d2f9bb45e054b38dd9ed1090c45f3bf.tar.gz
cpython-193e1be72d2f9bb45e054b38dd9ed1090c45f3bf.tar.bz2
Fixes Issue #6972: The zipfile module no longer overwrites files outside of
its destination path when extracting malicious zip files.
Diffstat (limited to 'Doc')
-rw-r--r--Doc/library/zipfile.rst17
1 files changed, 12 insertions, 5 deletions
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst
index 9f6e077..54f9b4b 100644
--- a/Doc/library/zipfile.rst
+++ b/Doc/library/zipfile.rst
@@ -242,6 +242,16 @@ ZipFile Objects
to extract to. *member* can be a filename or a :class:`ZipInfo` object.
*pwd* is the password used for encrypted files.
+ .. note::
+
+ If a member filename is an absolute path, a drive/UNC sharepoint and
+ leading (back)slashes will be stripped, e.g.: ``///foo/bar`` becomes
+ ``foo/bar`` on Unix, and ``ะก:\foo\bar`` becomes ``foo\bar`` on Windows.
+ And all ``".."`` components in a member filename will be removed, e.g.:
+ ``../../foo../../ba..r`` becomes ``foo../ba..r``. On Windows illegal
+ characters (``:``, ``<``, ``>``, ``|``, ``"``, ``?``, and ``*``)
+ replaced by underscore (``_``).
+
.. method:: ZipFile.extractall(path=None, members=None, pwd=None)
@@ -250,12 +260,9 @@ ZipFile Objects
be a subset of the list returned by :meth:`namelist`. *pwd* is the password
used for encrypted files.
- .. warning::
+ .. note::
- Never extract archives from untrusted sources without prior inspection.
- It is possible that files are created outside of *path*, e.g. members
- that have absolute filenames starting with ``"/"`` or filenames with two
- dots ``".."``.
+ See :meth:`extract` note.
.. method:: ZipFile.printdir()