mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-10-27 16:57:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Fixes Issue #6972: The zipfile module no longer overwrites files outside of

Browse source 
its destination path when extracting malicious zip files.
This commit is contained in:
Gregory P. Smith 2013-02-01 11:31:31 -08:00
commit 193e1be72d
4 changed files with 106 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Doc/library/zipfile.rst
View file

@ -242,6 +242,16 @@ ZipFile Objects
to extract to. *member* can be a filename or a :class:`ZipInfo` object.
*pwd* is the password used for encrypted files.
.. note::
If a member filename is an absolute path, a drive/UNC sharepoint and
leading (back)slashes will be stripped, e.g.: ``///foo/bar`` becomes
``foo/bar`` on Unix, and ``С:\foo\bar`` becomes ``foo\bar`` on Windows.
And all ``".."`` components in a member filename will be removed, e.g.:
``../../foo../../ba..r`` becomes ``foo../ba..r``. On Windows illegal
characters (``:``, ``<``, ``>``, ``|``, ``"``, ``?``, and ``*``)
replaced by underscore (``_``).
.. method:: ZipFile.extractall(path=None, members=None, pwd=None)
@ -250,12 +260,9 @@ ZipFile Objects
be a subset of the list returned by :meth:`namelist`. *pwd* is the password
used for encrypted files.
.. warning::
.. note::
Never extract archives from untrusted sources without prior inspection.
It is possible that files are created outside of *path*, e.g. members
that have absolute filenames starting with ``"/"`` or filenames with two
dots ``".."``.
See :meth:`extract` note.
.. method:: ZipFile.printdir()