Title: shutil.unpack_archive skips false negatives containing '..' · Issue #111791 · python/cpython · GitHub
Open Graph Title: shutil.unpack_archive skips false negatives containing '..' · Issue #111791 · python/cpython
X Title: shutil.unpack_archive skips false negatives containing '..' · Issue #111791 · python/cpython
Description: I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive. This is right, one file inside the archive is named somefile..ipynb, with two dots, likely misspelled. This leads to a problem, bec...
Open Graph Description: I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive. This is right, one file inside the archive is named somefile..ipynb, with two dots, likely ...
X Description: I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive. This is right, one file inside the archive is named somefile..ipynb, with two dots, likely ...
Opengraph URL: https://github.com/python/cpython/issues/111791
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"shutil.unpack_archive skips false negatives containing '..'","articleBody":"I tried to extract a ZIP archive which contains a file named `somefile..ipynb` using `shutil.unpack_archive`.\r\n\r\nThis is right, one file inside the archive is named `somefile..ipynb`, with two dots, likely misspelled.\r\n\r\nThis leads to a problem, because `unpack_archive` will skip extracting this file [here](https://github.com/python/cpython/blob/d4426e8d001cfb4590911e2e7de6963e12529faf/Lib/shutil.py#L1261), because it assumes that the file contains relative path components. The file is missing quietly in the extracted archive.\r\n\r\nWhile skipping the file is different from standard behavior, the assumption that a file with a path containing two dots would be a relative path is also wrong. A relative path component is identified by \"../\" instead.\r\n\r\n\r\nI ~~can~~ am going to submit a PR.\r\n\r\n\u003c!-- gh-linked-prs --\u003e\r\n### Linked PRs\r\n* gh-111824\r\n\u003c!-- /gh-linked-prs --\u003e\r\n","author":{"url":"https://github.com/sepastian","@type":"Person","name":"sepastian"},"datePublished":"2023-11-06T18:37:01.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/111791/cpython/issues/111791"}
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:a15ead5e-6617-bd8d-47d9-052dffdab1ee |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | 96BE:321E68:1D9854A:2B23542:6A563CC9 |
| html-safe-nonce | 9388bac9147d5b7cb0799f7abec20a11af0dc2543b32110b70eb1239aa6ef285 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5NkJFOjMyMUU2ODoxRDk4NTRBOjJCMjM1NDI6NkE1NjNDQzkiLCJ2aXNpdG9yX2lkIjoiNjgxNzYyMTk4MjY3NjY2MzQ5NyIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | d52dd39857c3d41cab26a987fb0a1fa980f28facf0066820eaae46142d254146 |
| hovercard-subject-tag | issue:1979820950 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/python/cpython/111791/issue_layout |
| twitter:image | https://opengraph.githubassets.com/e418d3a1425d9301e31621fb670324c7f784787a2fc1b67a92a0450ed738d0e8/python/cpython/issues/111791 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/e418d3a1425d9301e31621fb670324c7f784787a2fc1b67a92a0450ed738d0e8/python/cpython/issues/111791 |
| og:image:alt | I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive. This is right, one file inside the archive is named somefile..ipynb, with two dots, likely ... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | sepastian |
| hostname | github.com |
| expected-hostname | github.com |
| None | 96d96c6ad1e3234907759a5e634942d2ca0aded8a6ec1693a59d0f2c59c0dac9 |
| turbo-cache-control | no-preview |
| go-import | github.com/python/cpython git https://github.com/python/cpython.git |
| octolytics-dimension-user_id | 1525981 |
| octolytics-dimension-user_login | python |
| octolytics-dimension-repository_id | 81598961 |
| octolytics-dimension-repository_nwo | python/cpython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 81598961 |
| octolytics-dimension-repository_network_root_nwo | python/cpython |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | ec50befe6b611eee09bfe878347d87b8d5d2443f |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width