Skip to content

gh-151987: Pass filter_function to TarFile._extract_one() during .extract()#151988

Merged
encukou merged 9 commits into
python:mainfrom
encukou:tarfile-refilter-extract
Jun 29, 2026
Merged

gh-151987: Pass filter_function to TarFile._extract_one() during .extract()#151988
encukou merged 9 commits into
python:mainfrom
encukou:tarfile-refilter-extract

Conversation

@encukou

@encukou encukou commented Jun 23, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@encukou encukou requested a review from ethanfurman as a code owner June 23, 2026 12:29
@bedevere-app bedevere-app Bot mentioned this pull request Jun 23, 2026
Open
@encukou encukou added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes and removed awaiting core review labels Jun 23, 2026
@encukou encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 24, 2026
@bedevere-bot

bedevere-bot commented Jun 24, 2026

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit c2831a9 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151988%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 24, 2026
StanFromIreland
StanFromIreland approved these changes Jun 25, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread Lib/test/test_tarfile.py
@unittest.skipUnless(hasattr(os, 'geteuid'), "missing os.geteuid")
@support.subTests('link_type', (tarfile.SYMTYPE, tarfile.LNKTYPE))
def test_chown_links_on_extractall(self, link_type):
with ArchiveMaker() as arc:

@StanFromIreland StanFromIreland Jun 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These could be refactored, but due to the nature of this PR I don't think we need to delay with such things.

Comment thread Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst

@StanFromIreland StanFromIreland Jun 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security?

@encukou encukou Jun 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, if you think we should treat it as a security issue.

@StanFromIreland StanFromIreland Jun 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought that was what we decided by accepting python/cpython#GHSA-379m-ccvw-g66r. It does come out as low, so I don't have any opinions as to whether it needs an advisory (other than the news entry).

StanFromIreland
StanFromIreland approved these changes Jun 29, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jun 29, 2026
@encukou encukou merged commit 7ccdbab into python:main Jun 29, 2026
104 of 106 checks passed
@miss-islington-app

miss-islington-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@encukou encukou deleted the tarfile-refilter-extract branch June 29, 2026 15:41
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152608 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152609 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152610 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152611 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152612 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152613 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Jun 29, 2026
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.15] gh-151987: Pass filter_function to TarFile._extract_one() …
7b57e8d 
…during `.extract()` (GH-151988) (#152608)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.14] gh-151987: Pass filter_function to TarFile._extract_one() du…
5e0ef3f 
…ring `.extract()` (GH-151988) (#152609)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.13] gh-151987: Pass filter_function to TarFile._extract_one() du…
eee3ddf 
…ring `.extract()` (GH-151988) (#152610)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@encukou @bedevere-bot @StanFromIreland @sethmlarson