René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`zipfile.extractall` never restores stored Unix permissions","articleBody":"# Bug report\n\n### Bug description:\n\n`ZipInfo.from_file` stores the source file's Unix permissions in `external_attr`, but `ZipFile._extract_member` never reads them back. Extracted files are created with `open(targetpath, \"wb\")`, which applies the process umask (typically `0o644`). (And there isn't an `os.chmod` afterwards.)\n\nThis means a zip archive containing a file at `0o600` will extract it world-readable. `tarfile` for example on the other hand [does apply](https://github.com/python/cpython/blob/c6f7368157ecf9f2cdd537d8b6fad6e011bce344/Lib/tarfile.py#L2636-L2640) those attributes after extracting; `zipfile` silently discards the permission metadata it recorded.\n\nThis could be fixed by applying the stored mode after writing:\n\n```py\nwith self.open(member, pwd=pwd) as source, open(targetpath, \"wb\") as target:\n    shutil.copyfileobj(source, target)\n\nattr = member.external_attr \u003e\u003e 16\nif attr:\n    os.chmod(targetpath, attr)\n```\n\nNote that this isn't perfect either, as this leaves window of exposure (similar to what was reported in #96719), but it is a different bug (permissions restored after a while vs. permissions not reset at all).\n\n_I have [this branch](https://github.com/python/cpython/compare/main...KowalskiThomas:cpython:kowalski/fix-restore-permissions-after-extracting-zip) which updates it (with a regression test on top)._\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-150061\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/KowalskiThomas","@type":"Person","name":"KowalskiThomas"},"datePublished":"2026-05-14T16:51:22.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/149839/cpython/issues/149839"}