diff options
| author |   Artem Bulgakov <ArtemSBulgakov@ya.ru> | 2020-09-07 19:46:33 +0300 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2020-09-07 09:46:33 -0700 |
| commit | 22748a83d927d3da1beaed771be30887c42b2500 (patch) | |
| tree | 7bd2922fc537fd2af5c629a089e091eaa993325d /Lib/tarfile.py | |
| parent | bpo-41720: Add "return NotImplemented" in turtle.Vec2D.__rmul__(). (GH-22092) (diff) | |
| download | cpython-22748a83d927d3da1beaed771be30887c42b2500.tar.gz cpython-22748a83d927d3da1beaed771be30887c42b2500.tar.bz2 cpython-22748a83d927d3da1beaed771be30887c42b2500.zip | |
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
tarfile writes full path to FNAME field of GZIP format instead of just basename if user specified absolute path. Some archive viewers may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.
RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.
So tarfile must remove directory names from FNAME and write only basename of file.
Automerge-Triggered-By: @jaraco
Diffstat (limited to 'Lib/tarfile.py')
| -rwxr-xr-x | Lib/tarfile.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Lib/tarfile.py b/Lib/tarfile.py index 6769066cabd..1fae29430fe 100755 --- a/Lib/tarfile.py +++ b/Lib/tarfile.py @@ -420,6 +420,8 @@ class _Stream: self.__write(b"\037\213\010\010" + timestamp + b"\002\377") if self.name.endswith(".gz"): self.name = self.name[:-3] + # Honor "directory components removed" from RFC1952 + self.name = os.path.basename(self.name) # RFC1952 says we must use ISO-8859-1 for the FNAME field. self.__write(self.name.encode("iso-8859-1", "replace") + NUL) |