Skip to content

gh-151987: Pass filter_function to TarFile._extract_one() during .extract() - #151988

Merged
encukou merged 9 commits into
python:mainfrom
encukou:tarfile-refilter-extract
Jun 29, 2026
Merged

gh-151987: Pass filter_function to TarFile._extract_one() during .extract()#151988
encukou merged 9 commits into
python:mainfrom
encukou:tarfile-refilter-extract

Conversation

@encukou

@encukou encukou commented Jun 23, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member
@encukou
encukou requested a review from ethanfurman as a code owner June 23, 2026 12:29
@bedevere-app bedevere-app Bot mentioned this pull request Jun 23, 2026
Closed
@encukou encukou added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes and removed awaiting core review labels Jun 23, 2026
@encukou encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 24, 2026
@bedevere-bot

bedevere-bot commented Jun 24, 2026

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit c2831a9 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151988%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.
@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 24, 2026
StanFromIreland
StanFromIreland approved these changes Jun 25, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Comment thread Lib/test/test_tarfile.py
@unittest.skipUnless(hasattr(os, 'geteuid'), "missing os.geteuid")
@support.subTests('link_type', (tarfile.SYMTYPE, tarfile.LNKTYPE))
def test_chown_links_on_extractall(self, link_type):
with ArchiveMaker() as arc:

@StanFromIreland StanFromIreland Jun 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These could be refactored, but due to the nature of this PR I don't think we need to delay with such things.
Comment thread Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst

@StanFromIreland StanFromIreland Jun 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security?

@encukou encukou Jun 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, if you think we should treat it as a security issue.

@StanFromIreland StanFromIreland Jun 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought that was what we decided by accepting python/cpython#GHSA-379m-ccvw-g66r. It does come out as low, so I don't have any opinions as to whether it needs an advisory (other than the news entry).

@encukou encukou Jun 30, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, let's honor the decision then.
StanFromIreland
StanFromIreland approved these changes Jun 29, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jun 29, 2026
@encukou
encukou merged commit 7ccdbab into python:main Jun 29, 2026
104 of 106 checks passed
@miss-islington-app

miss-islington-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖
@encukou
encukou deleted the tarfile-refilter-extract branch June 29, 2026 15:41
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152608 is a backport of this pull request to the 3.15 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152609 is a backport of this pull request to the 3.14 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152610 is a backport of this pull request to the 3.13 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152611 is a backport of this pull request to the 3.12 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152612 is a backport of this pull request to the 3.11 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jun 29, 2026
@bedevere-app

bedevere-app Bot commented Jun 29, 2026

Copy link
Copy Markdown

GH-152613 is a backport of this pull request to the 3.10 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Jun 29, 2026
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.15] gh-151987: Pass filter_function to TarFile._extract_one() …
7b57e8d 
…during `.extract()` (GH-151988) (#152608)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.14] gh-151987: Pass filter_function to TarFile._extract_one() du…
5e0ef3f 
…ring `.extract()` (GH-151988) (#152609)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
StanFromIreland pushed a commit that referenced this pull request Jun 29, 2026
@miss-islington @encukou @sethmlarson
[3.13] gh-151987: Pass filter_function to TarFile._extract_one() du…
eee3ddf 
…ring `.extract()` (GH-151988) (#152610)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
pablogsal pushed a commit that referenced this pull request Jul 4, 2026
@miss-islington @encukou @sethmlarson
[3.11] gh-151987: Pass filter_function to TarFile._extract_one() duri…
d2b2f5e 
…ng .extract() (GH-151988) (#152612)

gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
pablogsal pushed a commit that referenced this pull request Jul 11, 2026
@miss-islington @encukou @sethmlarson
[3.10] gh-151987: Pass filter_function to TarFile._extract_one() duri…
cf23b91 
…ng .extract() (GH-151988) (#152613)

* gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>

* Remove newer test helpers

3.11+ has more granular platform support, mostly for WASI.
Use the 3.10 idioms instead:

- @symlink_test is a no-op on non-WASI platforms
- can_chmod is approximated by "not win32" elsewhere in test_tarfile

---------

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
Yhg1s pushed a commit that referenced this pull request Aug 4, 2026
@miss-islington @encukou @sethmlarson
[3.12] gh-151987: Pass filter_function to TarFile._extract_one() duri…
0367912 
…ng .extract() (GH-151988) (#152611)

gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988)

(cherry picked from commit 7ccdbab)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

4 participants

@encukou @bedevere-bot @StanFromIreland @sethmlarson