mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

[3.13] gh-123726: Document caveats of zipfile.Path around name sanitization (GH-130537) (#130986)

Browse source 
gh-123726: Document caveats of zipfile.Path around name sanitization (GH-130537)

Add a note to the `zipfile.Path` class documentation clarifying that it does not sanitize filenames. This emphasizes the caller's responsibility to validate or sanitize inputs, especially when handling untrusted ZIP archives, to prevent path traversal vulnerabilities. The note also references the `extract` and `extractall` methods for comparison and suggests using `os.path.abspath` and `os.path.commonpath` for safe filename resolution.
(cherry picked from commit a3990df612)

Co-authored-by: Affan Shaikhsurab <51104750+AffanShaikhsurab@users.noreply.github.com>
This commit is contained in:
Miss Islington (bot) 2025-03-08 22:43:12 +01:00 • committed by GitHub
parent fead51d808
commit aef7edaf23
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Doc/library/zipfile.rst
View file

@ -543,6 +543,14 @@ Path Objects
e.g. 'dir/file.txt', 'dir/', or ''. Defaults to the empty string,
indicating the root.
.. note::
The :class:`Path` class does not sanitize filenames within the ZIP archive. Unlike
the :meth:`ZipFile.extract` and :meth:`ZipFile.extractall` methods, it is the
caller's responsibility to validate or sanitize filenames to prevent path traversal
vulnerabilities (e.g., filenames containing ".." or absolute paths). When handling
untrusted archives, consider resolving filenames using :func:`os.path.abspath`
and checking against the target directory with :func:`os.path.commonpath`.
Path objects expose the following features of :mod:`pathlib.Path`
objects: