mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

bpo-41316: Make tarfile follow specs for FNAME (GH-21511)

Browse source 
tarfile writes full path to FNAME field of GZIP format instead of just basename if user specified absolute path. Some archive viewers may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.

RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.

So tarfile must remove directory names from FNAME and write only basename of file.

Automerge-Triggered-By: @jaraco
(cherry picked from commit 22748a83d9)

Co-authored-by: Artem Bulgakov <ArtemSBulgakov@ya.ru>
This commit is contained in:
Miss Skeleton (bot) 2020-10-20 22:29:00 -07:00 • committed by GitHub
parent 19019eccde
commit 7917170c5b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Lib/tarfile.py
View file

@ -420,6 +420,8 @@ class _Stream:
self.__write(b"\037\213\010\010" + timestamp + b"\002\377")
if self.name.endswith(".gz"):
self.name = self.name[:-3]
# Honor "directory components removed" from RFC1952
self.name = os.path.basename(self.name)
# RFC1952 says we must use ISO-8859-1 for the FNAME field.
self.__write(self.name.encode("iso-8859-1", "replace") + NUL)