]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-123726: Document caveats of zipfile.Path around name sanitization (GH-13053...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Sat, 8 Mar 2025 21:43:12 +0000 (22:43 +0100)
committerGitHub <noreply@github.com>
Sat, 8 Mar 2025 21:43:12 +0000 (21:43 +0000)
commitaef7edaf23e2bda80746375c0a8a0a0cf671a3c0
tree819eb4cee0cf87a03e2ce879c5aa980bbe1136b4
parentfead51d80834c978d6d7d0120db803bfd4343777
[3.13] gh-123726: Document caveats of zipfile.Path around name sanitization (GH-130537) (#130986)

gh-123726: Document caveats of zipfile.Path around name sanitization (GH-130537)

Add a note to the `zipfile.Path` class documentation clarifying that it does not sanitize filenames. This emphasizes the caller's responsibility to validate or sanitize inputs, especially when handling untrusted ZIP archives, to prevent path traversal vulnerabilities. The note also references the `extract` and `extractall` methods for comparison and suggests using `os.path.abspath` and `os.path.commonpath` for safe filename resolution.
(cherry picked from commit a3990df6121880e8c67824a101bb1316de232898)

Co-authored-by: Affan Shaikhsurab <51104750+AffanShaikhsurab@users.noreply.github.com>
Doc/library/zipfile.rst