This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: zipfile: Add absolute_path option, disabled by default
Type: security Stage: resolved
Components: Library (Lib) Versions: Python 3.7
process
Status: closed Resolution: not a bug
Dependencies: Superseder:
Assigned To: Nosy List: serhiy.storchaka, vstinner
Priority: normal Keywords:

Created on 2017-03-10 16:14 by vstinner, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
test2.zip vstinner, 2017-03-10 16:36
Messages (3)
msg289389 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2017-03-10 16:14
Same issue than tarfile issue #29788, but on zipfile.

I suggest to add a boolean absolute_path option to zipfile, disabled by default.
msg289391 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-03-10 16:19
Is this issue exists on zipfile?
msg289392 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2017-03-10 16:36
Oh, it seems like zipfile is not affected by the issue, only tarfile. The documentation is correct:
https://docs.python.org/dev/library/zipfile.html#zipfile.ZipFile.extract

You can test using attached test2.zip.

haypo@selma$ python3 -m zipfile -l ~/test2.zip 
File Name                                             Modified             Size
/home/haypo/test                               2017-03-10 17:29:06            5

haypo@selma$ cd $HOME
haypo@selma$ rm -rf z/
haypo@selma$ mkdir z
haypo@selma$ cd z
haypo@selma$ python3 -m zipfile -e ~/test2.zip .
haypo@selma$ find
.
./home
./home/haypo
./home/haypo/test
haypo@selma$ cat ~/test
cat: /home/haypo/test: No such file or directory
History
Date User Action Args
2022-04-11 14:58:44adminsetgithub: 73975
2017-03-10 16:36:40vstinnersetstatus: open -> closed
files: + test2.zip
messages: + msg289392

resolution: not a bug
stage: resolved
2017-03-10 16:19:26serhiy.storchakasetnosy: + serhiy.storchaka
messages: + msg289391
2017-03-10 16:14:54vstinnercreate