]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
authorMiss Skeleton (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 21 Oct 2020 05:29:00 +0000 (22:29 -0700)
committerGitHub <noreply@github.com>
Wed, 21 Oct 2020 05:29:00 +0000 (22:29 -0700)
commit7917170c5b4793ca9443f753aaecb8fbb3ad54ef
treec1f90dbf333ae5b4d256348c66803a2dbbd17e5f
parent19019eccdeeb8dea027bd7766ca9fe2892972da4
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)

tarfile writes full path to FNAME field of GZIP format instead of just basename if user specified absolute path. Some archive viewers may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.

RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.

So tarfile must remove directory names from FNAME and write only basename of file.

Automerge-Triggered-By: @jaraco
(cherry picked from commit 22748a83d927d3da1beaed771be30887c42b2500)

Co-authored-by: Artem Bulgakov <ArtemSBulgakov@ya.ru>
Lib/tarfile.py
Lib/test/test_tarfile.py
Misc/ACKS
Misc/NEWS.d/next/Library/2020-07-28-12-08-58.bpo-41316.bSCbK4.rst [new file with mode: 0644]