Repository navigation
Conversation
pythongh-160097 gave tar_filter the "link at the destination" check that data_filter had, but made it lexical (the member's normalised name is '.'), so link members that reach the destination through '..' or symlinks passed even filter='data': * '../dest' now raised RecursionError instead of OutsideDestinationError; * 's' -> '.' followed by a hard link 's/.' changed the destination directory's own mode; * '../current', where 'current' is an existing symlink outside the destination pointing at it, deleted that symlink and wrote later members outside the destination. A link is made at its own path without following whatever is already there, so check that path with only its parent directory resolved, and require it to be strictly inside the destination. This covers all of the above for both filters, also rejects a link whose parent is reached through an earlier symlink member leading outside, and avoids the false positive of the old resolved-path check when re-extracting an archive containing a symlink to '.'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019EeY1aVDfL7Y3eMxYWdYgc
gpshead
marked this pull request as draft
October 29, 2026 03:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix a security vulnerability in
tarfile.tar_filter()andtarfile.data_filter()where symlink and hardlink members could reach the destination directory or existing symlinks outside it through..components or earlier symlink members in the archive.Changes
Core Fix (Lib/tarfile.py)
Modified the link validation logic in
_get_filtered_attrs()to:This prevents attackers from using constructs like:
../destsymlinks that reach the destinations/.hardlinks wheresis a symlink to..Tests (Lib/test/test_tarfile.py)
Added three comprehensive test cases:
test_link_reaching_destination(): Verifies rejection of links reaching destination via..or symlink traversaltest_link_replacing_outer_symlink(): Ensures links cannot replace existing symlinks outside the destinationtest_link_to_dot_reextracted(): Confirms symlinks to.can be re-extracted correctlyDocumentation (Doc/library/tarfile.rst)
Updated documentation to clarify that:
Test Plan
All new tests pass with both 'tar' and 'data' filters. Existing tarfile tests continue to pass, confirming backward compatibility for legitimate use cases.
https://claude.ai/code/session_019EeY1aVDfL7Y3eMxYWdYgc