Repository navigation
Commit 8dd0276
gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (GH-138147)
The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball.
Since the script does not necessarily use Python 3.14 or later (where the `"data"`
filter became the default `tarfile` extraction filter), the user may theoretically
suffer from a path traversal attack.
Although the script should not be used in production and usually relies on downloading
trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant.
(cherry picked from commit 31d3836)
Co-authored-by: Tommaso Bona <piergeolo@gmail.com>
1 parent 573589c commit 8dd0276
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -292,7 +292,7 @@ def _unpack_src(self): | |||
| 292 | 292 | raise ValueError(member.name, base) | |
| 293 | 293 | member.name = member.name[len(base):].lstrip('/') | |
| 294 | 294 | log.info("Unpacking files to {}".format(self.build_dir)) | |
| 295 | - tf.extractall(self.build_dir, members) | ||
| 295 | + tf.extractall(self.build_dir, members, filter='data') | ||
| 296 | 296 | ||
| 297 | 297 | def _build_src(self, config_args=()): | |
| 298 | 298 | """Now build openssl""" | |
0 commit comments