Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32.1k
[3.11] gh-135034: Normalize link targets in tarfile, addos.path.realpath(strict='allow_missing') (GH-135037)#135068
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…th.realpath(strict='allow_missing')` (pythonGH-135037)Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.(cherry picked from commit3612d8f)(cherry picked from commitc358142)Co-authored-by: Łukasz Langa <lukasz@langa.pl>Signed-off-by: Łukasz Langa <lukasz@langa.pl>Co-authored-by: Petr Viktorin <encukou@gmail.com>Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
non-strict test for unreadable symlinks, whch isn't supported before 3.13.
4633f3f intopython:3.11Uh oh!
There was an error while loading.Please reload this page.
After this update, I am getting the following test failure: ======================================================================ERROR:test_realpath_limit_attack (test.test_tarfile.TestExtractionFilters.test_realpath_limit_attack) [fully_trusted]----------------------------------------------------------------------Traceback (most recent call last): File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/test/test_tarfile.py", line3669, intest_realpath_limit_attackwith (self.subTest('fully_trusted'), File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/contextlib.py", line137, in__enter__returnnext(self.gen)^^^^^^^^^^^^^^ File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/test/test_tarfile.py", line3458, incheck_contextself.expected_paths=set(self.outerdir.glob('**/*'))^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line958, inglobfor pin selector.select_from(self): File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line411, in_select_fromfor starting_pointinself._iterate_directories(parent_path, is_dir, scandir): File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line401, in_iterate_directoriesfor pinself._iterate_directories(path, is_dir, scandir): File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line401, in_iterate_directoriesfor pinself._iterate_directories(path, is_dir, scandir): File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line401, in_iterate_directoriesfor pinself._iterate_directories(path, is_dir, scandir): [Previous line repeated 14 more times] File"/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/Python-3.11.13/Lib/pathlib.py", line395, in_iterate_directories entry_is_dir= entry.is_dir(follow_symlinks=False)^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^OSError:[Errno 78] File name too long: '/builds/jkulik/python-3.13.4-3.11.13-3.9.23/components/python/python311/build/amd64/build/test_python_22904æ/@test_22904_tmpæ-tardir/outerdir/dest/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/ddddddddddddddddddddddddddddddddddddddddddddddddddd/llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll' Interestingly, it's just 3.11.13 that's failing - both 3.9.23 and 3.13.4 (and all other supported versions we are running in our internal buildbot) pass. 3.13 has a very different pathlib implementation, but 3.9 is pretty similar so I investigated the differences, and when I print the entires from here (_iterate_directories3.9 /3.11): I get very different results: 3.11: Also, the This is on Oracle Solaris. |
Ah! We got the same test failure in 3.10, so I hotfixed it there. Try applying the hack to 3.11:dff62a1 It's just a test failure: if the filter is |
kulikjak commentedJun 4, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Oh, that fixed it. Thanks! (i didn't realize that this difference between 3.9 and 3.11 is what causes the issue) |
DimNik9 commentedJun 5, 2025
Hello, sorry to ask directly here but i haven't understood how 3.10 & 3.11 are affected by these CVEs, since the description of each CVE states that ONLY versions after 3.12 are affected, since the extraction filters were first introduced in 3.12 |
yeah, looks like the CVE text needs an update :( |
@encukou Gotcha, I didn't realize that filtering had been backported, I'll update the prose description in each document. The affectedness of the CVEs is correct thankfully :) |
Updated the CVE records and sent a correction to |
Uh oh!
There was an error while loading.Please reload this page.
Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.
(cherry picked from commit3612d8f)
Co-authored-by: Łukasz Langalukasz@langa.pl
Co-authored-by: Petr Viktorinencukou@gmail.com
Co-authored-by: Seth Michael Larsonseth@python.org
Co-authored-by: Adam Turner9087854+AA-Turner@users.noreply.github.com
Co-authored-by: Serhiy Storchakastorchaka@gmail.com
filter="tar"/filter="data") #135034📚 Documentation preview 📚:https://cpython-previews--135068.org.readthedocs.build/