Title: gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction by Shrey-N · Pull Request #146588 · python/cpython · GitHub
Open Graph Title: gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction by Shrey-N · Pull Request #146588 · python/cpython
X Title: gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction by Shrey-N · Pull Request #146588 · python/cpython
Description: This PR refactors shutil._unpack_zipfile to use zipfile.ZipFile.extractall() instead of a manual extraction loop. This resolves a directory traversal vulnerability on Windows where archives containing drive prefixed paths for exampleD:/file.txt could write files outside the intended destination directory. Changes Made Replaced manual path joining and validation with ZipFile.extractall(), which leverages the zipfile module Updated the _unpack_zipfile signature to accept **kwargs. This ensures compatibility with the filter argument, preventing TypeError while allowing future filter support for ZIP files. This change brings ZIP extraction in line with how shutil handles TAR files, which already uses extractall(). Regression Test Added a new test case test_unpack_zipfile_traversal_windows_drive to Lib/test/test_shutil.py. This test specifically verifies that a ZIP file containing a drive prefixed path is safely sanitized and extracted within the intended extract_dir on Windows. Linked Issue #146581 Issue: gh-146581
Open Graph Description: This PR refactors shutil._unpack_zipfile to use zipfile.ZipFile.extractall() instead of a manual extraction loop. This resolves a directory traversal vulnerability on Windows where archives contain...
X Description: This PR refactors shutil._unpack_zipfile to use zipfile.ZipFile.extractall() instead of a manual extraction loop. This resolves a directory traversal vulnerability on Windows where archives contain...
Opengraph URL: https://github.com/python/cpython/pull/146588
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:ad184f21-fe6e-909d-2898-7ee731282565 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | B0F8:31B5FB:77830B:AEE488:6A5616C3 |
| html-safe-nonce | 8ceaa513aaec0a81e936e96021febcdfac7b702c54bbb2f60713a924f1534e8f |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJCMEY4OjMxQjVGQjo3NzgzMEI6QUVFNDg4OjZBNTYxNkMzIiwidmlzaXRvcl9pZCI6IjY0NTE0MDI5ODQ3NzM3ODUyODMiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 91ce24cabcba3ca94ad11d38da38d376d5ead74be402d9f5d922143441f026e1 |
| hovercard-subject-tag | pull_request:3462108772 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/python/cpython/pull/146588/files |
| twitter:image | https://avatars.githubusercontent.com/u/221686259?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/221686259?s=400&v=4 |
| og:image:alt | This PR refactors shutil._unpack_zipfile to use zipfile.ZipFile.extractall() instead of a manual extraction loop. This resolves a directory traversal vulnerability on Windows where archives contain... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | f4368738fc918fecd9b3958f6b49218bbe60d4185f38e72e3954e11f1ad0213a |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/python/cpython git https://github.com/python/cpython.git |
| octolytics-dimension-user_id | 1525981 |
| octolytics-dimension-user_login | python |
| octolytics-dimension-repository_id | 81598961 |
| octolytics-dimension-repository_nwo | python/cpython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 81598961 |
| octolytics-dimension-repository_network_root_nwo | python/cpython |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | b76b9cc70d30da50674184c9c66c56423fd0b93c |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width