Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 #112887

Closed
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue
@ChuckWoodraska

Description

@ChuckWoodraska

Bug report

Bug description:

From the docshttps://docs.python.org/3.11/library/tarfile.html#tarfile.data_filter it sounds like setting errorlevel to 0 and having a filter should logged that the offending member was skipped and continue extraction. It looks like it actually logs the filter error and extracts the offending member. The below code shows the filtererror and the extraction.

From the docs: When a filter refuses to extract a file, it will raise an appropriate exception, a subclass ofFilterError. This will abort the extraction ifTarFile.errorlevel is 1 or more. With errorlevel=0 the error will be logged and the member will be skipped, but extraction will continue.

I was expecting it to tell me the file it skipped and not have any extraction with the given code.

importtarfilewithopen('test.txt','w')asf:f.write('Hello')withtarfile.open('my_archive.tar','w:xz')astar:tar.add('test.txt',arcname='../test.txt')withtarfile.open("my_archive.tar")astar:tar.debug=Truetar.errorlevel=0print(tar.errorlevel)tar.extractall(filter="data")

CPython versions tested on:

3.11

Operating systems tested on:

macOS

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp