]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-123726: Document caveats of zipfile.Path around name sanitization (#130537)
authorAffan Shaikhsurab <51104750+AffanShaikhsurab@users.noreply.github.com>
Sat, 8 Mar 2025 21:37:05 +0000 (03:07 +0530)
committerGitHub <noreply@github.com>
Sat, 8 Mar 2025 21:37:05 +0000 (16:37 -0500)
commita3990df6121880e8c67824a101bb1316de232898
treed4099e7b243cf4ab7030c6aa4116f7596c3c7522
parentedd1eca336976b3431cf636aea87f08a40c94935
gh-123726: Document caveats of zipfile.Path around name sanitization (#130537)

Add a note to the `zipfile.Path` class documentation clarifying that it does not sanitize filenames. This emphasizes the caller's responsibility to validate or sanitize inputs, especially when handling untrusted ZIP archives, to prevent path traversal vulnerabilities. The note also references the `extract` and `extractall` methods for comparison and suggests using `os.path.abspath` and `os.path.commonpath` for safe filename resolution.
Doc/library/zipfile.rst