From 31d3836f26096f9503ca68f4e89d927bc1e060cd Mon Sep 17 00:00:00 2001 From: Tommaso Bona Date: Sat, 30 Aug 2025 12:27:32 +0200 Subject: [PATCH] gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (#138147) The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball. Since the script does not necessarily use Python 3.14 or later (where the `"data"` filter became the default `tarfile` extraction filter), the user may theoretically suffer from a path traversal attack. Although the script should not be used in production and usually relies on downloading trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant. --- Tools/ssl/multissltests.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py index e632adafaaa0..c0559446982e 100755 --- a/Tools/ssl/multissltests.py +++ b/Tools/ssl/multissltests.py @@ -306,7 +306,7 @@ class AbstractBuilder(object): raise ValueError(member.name, base) member.name = member.name[len(base):].lstrip('/') log.info("Unpacking files to {}".format(self.build_dir)) - tf.extractall(self.build_dir, members) + tf.extractall(self.build_dir, members, filter='data') def _build_src(self, config_args=()): """Now build openssl""" -- 2.47.3