This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author martin.panter
Recipients Daniel.Garcia, benjamin.peterson, christian.heimes, georg.brandl, larry, lars.gustaebel, martin.panter, ned.deily, r.david.murray, serhiy.storchaka, vstinner
Date 2014-04-17.08:41:35
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Seems like shutil._unpack_tarfile() is affected. I guess it could at least do with one of those warnings in the documentation for make_archive().

The patch for this bug looks a bit over enthusiastic, for example skip_prefixes("blaua../stuff") would incorrectly strip the first bit and just return "stuff".

It seems there might already be plenty of existing code to check for bad paths. Examples that come to mind:

* http.server.SimpleHTTPRequestHandler.translate_path()
* zipfile.ZipFile._extract_member()
* shutil._unpack_zipfile()

This code either ignores the bad path elements, or ignores the whole path. Perhaps some of it could be recycled into a common function somewhere, rather than implementing it all over again for tar files.

I have written my own function joinpath() to do this sort of checking, which you are welcome to use:

You would call it with something like joinpath(tarpath.split("/"), osdir).
Date User Action Args
2014-04-17 08:41:36martin.pantersetrecipients: + martin.panter, georg.brandl, lars.gustaebel, vstinner, larry, christian.heimes, benjamin.peterson, ned.deily, r.david.murray, serhiy.storchaka, Daniel.Garcia
2014-04-17 08:41:36martin.pantersetmessageid: <>
2014-04-17 08:41:36martin.panterlinkissue21109 messages
2014-04-17 08:41:35martin.pantercreate