gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` #135037

ambv · 2025-06-02T16:24:54Z

Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.

[edit @encukou]: Also addresses CVE-2025-4435. Sorry for leaving that out of the commit messages.

Co-authored-by: Petr Viktorin encukou@gmail.com
Signed-off-by: Łukasz Langa lukasz@langa.pl

Issue: Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") #135034

📚 Documentation preview 📚: https://cpython-previews--135037.org.readthedocs.build/

…path(strict='allow_missing')` Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Co-authored-by: Petr Viktorin <encukou@gmail.com> Signed-off-by: Łukasz Langa <lukasz@langa.pl>

serhiy-storchaka · 2025-06-02T17:06:49Z

See also #71189.

Lib/test/test_tarfile.py

Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>

Lib/test/test_tarfile.py

Lib/test/test_ntpath.py

encukou · 2025-06-02T22:29:32Z

See also #71189.

To align with this, there'd be a ntpath.ALLOW_MISSING singleton rather than an 'allow_missing' string.
That's possible, of course. It can catch typos. But I don't think it's worth having to import an extra name.

bedevere-bot · 2025-06-02T23:14:05Z

🤖 New build scheduled with the buildbot fleet by @encukou for commit 5af66c6 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135037%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

This reverts commit fd2013a.

miss-islington-app · 2025-06-03T10:47:04Z

Thanks @ambv for the PR, and @Yhg1s for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2025-06-03T10:47:11Z

Sorry, @ambv and @Yhg1s, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 3612d8f51741b11f36f8fb0494d79086bac9390a 3.14

miss-islington-app · 2025-06-03T10:47:16Z

Sorry, @ambv and @Yhg1s, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 3612d8f51741b11f36f8fb0494d79086bac9390a 3.13

…th.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-06-03T10:59:49Z

GH-135064 is a backport of this pull request to the 3.13 branch.

…path(strict='allow_missing')` (python#135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> (cherry picked from commit 3612d8f)

bedevere-app · 2025-06-03T11:14:14Z

GH-135065 is a backport of this pull request to the 3.14 branch.

…th.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-06-03T11:25:58Z

GH-135066 is a backport of this pull request to the 3.12 branch.

…th.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) (cherry picked from commit c358142) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-06-03T11:45:40Z

GH-135068 is a backport of this pull request to the 3.11 branch.

…th.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) (cherry picked from commit c358142) (cherry picked from commit 371b4ea) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-06-03T12:00:53Z

GH-135070 is a backport of this pull request to the 3.10 branch.

…lpath(strict='allow_missing')` (gh-135037) (gh-135065) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…h.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…h.realpath(strict='allow_missing')` (pythonGH-135037) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-06-03T13:37:05Z

GH-135084 is a backport of this pull request to the 3.9 branch.

…lpath(strict='allow_missing')` (GH-135037) (GH-135064) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…lpath(strict='allow_missing')` (GH-135037) (GH-135066) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…lpath(strict='allow_missing')` (GH-135037) (GH-135068) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) (cherry picked from commit c358142) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…lpath(strict='allow_missing')` (GH-135037) (#135070) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) (cherry picked from commit c358142) (cherry picked from commit 371b4ea) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…path(strict='allow_missing')` (GH-135037) (GH-135084) Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

encukou · 2025-06-04T08:53:22Z

This does fix CVE-2025-4435. Sorry for leaving that out of the commit message.

(Thanks @stratakis for asking!)

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

0c16f5f

…path(strict='allow_missing')` Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. Co-authored-by: Petr Viktorin <encukou@gmail.com> Signed-off-by: Łukasz Langa <lukasz@langa.pl>

ambv requested a review from ethanfurman as a code owner June 2, 2025 16:24

bedevere-app bot added the awaiting core review label Jun 2, 2025

bedevere-app bot mentioned this pull request Jun 2, 2025

Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") #135034

Closed

ambv and others added 2 commits June 2, 2025 18:30

Fix lint

335921b

Add blurb

fcefa72

Fix test_tarfile on WASI

9c275a7

ambv force-pushed the gh-135034 branch from d25f924 to 9c275a7 Compare June 2, 2025 17:30

Remove spurious line

b59eaaa

AA-Turner reviewed Jun 2, 2025

View reviewed changes

Lib/test/test_tarfile.py Outdated Show resolved Hide resolved

ambv and others added 3 commits June 2, 2025 22:10

Fix invalid parent directory unwinding in test

fd5ba13

Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>

Make tests more chatty

aeebdc8

Use a better skip

f5544e6

encukou reviewed Jun 2, 2025

View reviewed changes

Lib/test/test_tarfile.py Outdated Show resolved Hide resolved

encukou reviewed Jun 2, 2025

View reviewed changes

Lib/test/test_ntpath.py Outdated Show resolved Hide resolved

ambv and others added 2 commits June 3, 2025 00:31

Work around Windows test failures

3c5ed15

Add ERROR_ACCESS_DENIED

5af66c6

encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 2, 2025

encukou and others added 7 commits June 3, 2025 01:14

Switch to singleton

a124c42

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

Add ENAMETOOLONG to expected failures. And an extra subTest.

5bf4a48

Discard more special files

3b54acd

Use shorter names on Android

7ff96a2

Fix docs warning

f845343

Attempt to restore ntpath test

fd2013a

Revert "Attempt to restore ntpath test"

f8f2786

This reverts commit fd2013a.

encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 3, 2025

miss-islington-app bot assigned Yhg1s Jun 3, 2025

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jun 3, 2025

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jun 3, 2025

This was referenced Jun 4, 2025

gh-112887: Fix tarfile FilterError handling to skip member extraction #112954

Closed

[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 #112887

Closed

This was referenced Jun 4, 2025

Add: Relicense doc and template greenbone/ospd-openvas#1042

Closed

Migrate to modern datetime interface greenbone/ospd-openvas#1043

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` #135037

gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` #135037

ambv commented Jun 2, 2025 •

edited by encukou

Loading

Uh oh!

serhiy-storchaka commented Jun 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

encukou commented Jun 2, 2025

Uh oh!

bedevere-bot commented Jun 2, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

encukou commented Jun 4, 2025

Uh oh!

Uh oh!

Uh oh!

gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') #135037

gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') #135037

Conversation

ambv commented Jun 2, 2025 • edited by encukou Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serhiy-storchaka commented Jun 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

encukou commented Jun 2, 2025

Uh oh!

bedevere-bot commented Jun 2, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

miss-islington-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

bedevere-app bot commented Jun 3, 2025

Uh oh!

encukou commented Jun 4, 2025

Uh oh!

Uh oh!

gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` #135037

gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` #135037

ambv commented Jun 2, 2025 •

edited by encukou

Loading