-
-
Notifications
You must be signed in to change notification settings - Fork 32.7k
gh-111791: delegating extraction to zipfile module's extractall() method #111824
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
gh-111791: delegating extraction to zipfile module's extractall() method #111824
Conversation
…to zipfile shutil.unpack_archive fails, if file name contains '..'; zipfile handles everything correctly, i.e. in the same way than 'unzip'; let zipfile unpack archives, instead of reinventing the wheel here
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Filenames containing two dots ".." do not necessarily indicate relative path components. Only "../" identify a relative path component.
This is a bug that needs to be fixed. Any progress on this? |
shutil.unpack_archive: deletage extracting ZIP files to
zipfile
(#111791)As reported in #111791, if the path of a file inside a ZIP file contains
".."
, e.g.myfile..txt
(probably misspelled),shutil.unpack_archive
will silently skip extracting the file, because it wrongly assumes a relative path.This is problematic for two reasons:
shutil.unpack_archive
wrongly identifies relative path components. Scanning for".."
does not tell whether a path contains relative components, or not; one must scan for"../"
instead.Python's own
zipfile
module and theunzip
are handling relative path components"../"
and names containins".."
correctly. For reference, theman unzip
page says:Solution: delegate extracting ZIP archives to Python's own
zipfile.extractall
method.Appendix
The following example shows, how extracting a ZIP archive containing paths containing relative components
"../"
and files with names containing".."
differs inshutil.unpack_archive
,zipfile.extractall
and the Linux toolunzip
.