[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 #112887
Labels
stdlib
Python modules in the Lib dir
type-bug
An unexpected behavior, bug, or error
type-security
A security issue
Uh oh!
There was an error while loading. Please reload this page.
Bug report
Bug description:
From the docs https://docs.python.org/3.11/library/tarfile.html#tarfile.data_filter it sounds like setting errorlevel to 0 and having a filter should logged that the offending member was skipped and continue extraction. It looks like it actually logs the filter error and extracts the offending member. The below code shows the filtererror and the extraction.
From the docs: When a filter refuses to extract a file, it will raise an appropriate exception, a subclass of FilterError. This will abort the extraction if TarFile.errorlevel is 1 or more. With errorlevel=0 the error will be logged and the member will be skipped, but extraction will continue.
I was expecting it to tell me the file it skipped and not have any extraction with the given code.
CPython versions tested on:
3.11
Operating systems tested on:
macOS
Linked PRs
The text was updated successfully, but these errors were encountered: