]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multisslte...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Sat, 30 Aug 2025 10:49:45 +0000 (12:49 +0200)
committerGitHub <noreply@github.com>
Sat, 30 Aug 2025 10:49:45 +0000 (10:49 +0000)
commit8dd027602dc57997a98bbb2fec3ee10473bf012f
treeb27891e0c1ffc3483a0bfcab68de78b9f4489dbd
parent573589cf75f8fd60221aa46cf0fca06039e0c7a6
[3.13] gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (GH-138147) (#138263)

gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (GH-138147)

The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball.
Since the script does not necessarily use Python 3.14 or later (where the `"data"`
filter became the default `tarfile` extraction filter), the user may theoretically
suffer from a path traversal attack.

Although the script should not be used in production and usually relies on downloading
trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant.
(cherry picked from commit 31d3836f26096f9503ca68f4e89d927bc1e060cd)

Co-authored-by: Tommaso Bona <piergeolo@gmail.com>
Tools/ssl/multissltests.py