gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` by ParzivalHack · Pull Request #138147 · python/cpython · GitHub

This pull request addresses a path traversal vulnerability in the Tools/ssl/multissltests.py script. The vulnerability allows for a crafted tarball to write an arbitrary file to a location outside of the intended build directory due to a lack of sanitization in the _unpack_src method's handling of tarball member names.

A comprehensive, self-contained PoC script was used to demonstrate the issue (and shared with the PSRT), confirming the Path Traversal. The fix implemented in this PR ensures that each tarball member is manually extracted with a path check, preventing any file from escaping the designated directory. This approach provides a clear and robust solution to the issue.

As this is a test script, and not a production component, the Python Security Response Team (PSRT) has advised me to submitt it as a public enhancement. This fix ensures the integrity and robustness of the tool, by preventing an unprivileged file write that could lead to unexpected behavior.

I am submitting this enhancement to improve the overall quality of the CPython test suite. If necessary, I'm available to provide any additional information required for review.

Issue: Fix Path Traversal in multissltests.py #138158

Fix of a Path Traversal vulnerability in a test script in multissltests.py

All commit authors signed the Contributor License Agreement.

It seems you have several unrelated whitespace changes; please revert.

A

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

FYI These are the whitespace changes that should be reverted:

Reverted the unrelated whitespace changes

I have made the requested changes; please review again

Thanks for making the requested changes!

@AA-Turner: please review the changes made to this pull request.

This PR overcomplicates a script that is already complex. The URLs are safe as they are hardcoded. I don't think we need to worry about this kind of attack, unless upstream is affected (namely official openssl, libressl or aws-lc repositories).

Has this PR been generated by AI?

Whatever we choose to do, an issue should be opened first. However, I don't think such change is needed, but to be on the perfectly safe side, we could just specify the filter in extractall.

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Remove additional whitespace Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

This commit refactors the _unpack_src function to use the filter='data' argument in tarfile.extractall(). This change addresses the path traversal vulnerability more robustly, as suggested during code review. It also improves code clarity and removes the need for manual path validation checks.

Using the data filter seems harmless. I agree with Ben (& the PSRT) though that there is no practical 'vulnerability' here, so this is largely a change for theoretical purposes. As such, I'm +0; will leave to someone else to decide to merge.

A

+0

I thought about this a lot, because I originally didn't want un-necessary churn, even if it's helpful. However, it's actually possible for the user to skip the download part and directly specify a directory where the lib sources are. So, assuming that this directory is untrusted, it's entirely possible to have a bad archive out there. The attack surface is really small as this requires executing the script in a non-standard way, but I think it's a legitimate improvement.

I need to test it locally though, (or @ParzivalHack, could you check that this effectively prevents the PT attack and share your PoC please?).

I thought about this a lot, because I originally didn't want un-necessary churn, even if it's helpful. However, it's actually possible for the user to skip the download part and directly specify a directory where the lib sources are. So, assuming that this directory is untrusted, it's entirely possible to have a bad archive out there. The attack surface is really small as this requires executing the script in a non-standard way, but I think it's a legitimate improvement.

I need to test it locally though, (or @ParzivalHack, could you check that this effectively prevents the PT attack and share your PoC please?).

Hey @picnixz,
Thanks for your feedback and for looking into this (again). I've re-tested the fix locally and can confirm that using the filter='data' argument fully prevents the path traversal attack.

I've put together a small (but detailed) repo with the PoC script, including a README.md that shows a side-by-side comparison of the vulnerable and patched outcomes.

You can check it out here: https://github.com/ParzivalHack/PT-PoC

Lmk if there's anything else I can do👍

Thank you for the PoC. Actually, I just looked at the docs for tarfile, but apparently, the data filter is the default filter for Python 3.14 and later. Which version are you using for Python? with Python 3.14+, extractall() shouldn't need to specify its extraction filter.

Thank you for the PoC. Actually, I just looked at the docs for tarfile, but apparently, the data filter is the default filter for Python 3.14 and later. Which version are you using for Python? with Python 3.14+, extractall() shouldn't need to specify its extraction filter.

No worries. And i was running everything with Python 3.13.3👍

So that's the reason why it's vulnerable. However, as I mentioned on the issue, if someone is using Python 3.13 and below for PYTHON_FOR_REGEN, then they could suffer from this so I'm ok with this change.

So that's the reason why it's vulnerable. However, as I mentioned on the issue, if someone is using Python 3.13 and below for PYTHON_FOR_REGEN, then they could suffer from this so I'm ok with this change.

Hey @picnixz,
Thanks for your review and feedback. Appreciate your help in getting this resolved.

Thanks again for the opportunity to contribute :)

Thanks @ParzivalHack for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

…/ssl/multissltests.py` (pythonGH-138147) The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball. Since the script does not necessarily use Python 3.14 or later (where the `"data"` filter became the default `tarfile` extraction filter), the user may theoretically suffer from a path traversal attack. Although the script should not be used in production and usually relies on downloading trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant. (cherry picked from commit 31d3836) Co-authored-by: Tommaso Bona <piergeolo@gmail.com>

GH-138262 is a backport of this pull request to the 3.14 branch.

GH-138263 is a backport of this pull request to the 3.13 branch.

…s/ssl/multissltests.py` (GH-138147) (#138263) gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (GH-138147) The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball. Since the script does not necessarily use Python 3.14 or later (where the `"data"` filter became the default `tarfile` extraction filter), the user may theoretically suffer from a path traversal attack. Although the script should not be used in production and usually relies on downloading trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant. (cherry picked from commit 31d3836) Co-authored-by: Tommaso Bona <piergeolo@gmail.com>

…s/ssl/multissltests.py` (GH-138147) (#138262) Co-authored-by: Tommaso Bona <piergeolo@gmail.com>

… `Tools/ssl/multissltests.py` (pythonGH-138147) (python#138262) Co-authored-by: Tommaso Bona <piergeolo@gmail.com>

…/ssl/multissltests.py` (python#138147) The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball. Since the script does not necessarily use Python 3.14 or later (where the `"data"` filter became the default `tarfile` extraction filter), the user may theoretically suffer from a path traversal attack. Although the script should not be used in production and usually relies on downloading trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant.

Fix Path Traversal in multissltests.py

52110d7

Fix of a Path Traversal vulnerability in a test script in multissltests.py

ParzivalHack requested review from gpshead and picnixz as code owners August 25, 2025 18:16

bedevere-app Bot added the awaiting review label Aug 25, 2025

This comment was marked as resolved.

Sign in to view

StanFromIreland added skip news tests Tests in the Lib/test dir topic-SSL labels Aug 25, 2025

AA-Turner previously requested changes Aug 26, 2025

View reviewed changes

bedevere-app Bot added awaiting changes and removed awaiting review labels Aug 26, 2025

Update multissltests.py

7276b4f

Reverted the unrelated whitespace changes

bedevere-app Bot added awaiting change review and removed awaiting changes labels Aug 26, 2025

bedevere-app Bot requested a review from AA-Turner August 26, 2025 07:58

StanFromIreland reviewed Aug 26, 2025

View reviewed changes

Comment thread Tools/ssl/multissltests.py Outdated

picnixz reviewed Aug 26, 2025

View reviewed changes

picnixz previously requested changes Aug 26, 2025

View reviewed changes

Comment thread Tools/ssl/multissltests.py Outdated

Comment thread Tools/ssl/multissltests.py Outdated

Comment thread Tools/ssl/multissltests.py

bedevere-app Bot removed the awaiting change review label Aug 26, 2025

bedevere-app Bot added the awaiting changes label Aug 26, 2025

picnixz added the DO-NOT-MERGE label Aug 26, 2025

ParzivalHack and others added 2 commits August 26, 2025 11:40

Update Tools/ssl/multissltests.py

d264c0d

Remove additional whitespace Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

picnixz removed the DO-NOT-MERGE label Aug 26, 2025

AA-Turner reviewed Aug 26, 2025

View reviewed changes

bedevere-app Bot added awaiting review and removed awaiting change review labels Aug 26, 2025

ParzivalHack requested a review from picnixz August 28, 2025 21:23

picnixz approved these changes Aug 30, 2025

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels Aug 30, 2025

picnixz added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Aug 30, 2025

picnixz changed the title gh-138158: Use the 'data' tarfile filter for multissltests gh-138158: Use the "data" tarfile extraction filter in Tools/ssl/multissltests.py Aug 30, 2025

picnixz merged commit 31d3836 into python:main Aug 30, 2025

bedevere-app Bot removed the awaiting merge label Aug 30, 2025

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Aug 30, 2025

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Aug 30, 2025

hugovk pushed a commit that referenced this pull request Aug 31, 2025

[3.14] gh-138158 : Use the "data" tarfile extraction filter in `Tool…

b79bece

…s/ssl/multissltests.py` (GH-138147) (#138262) Co-authored-by: Tommaso Bona <piergeolo@gmail.com>

gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` by ParzivalHack · Pull Request #138147 · python/cpython · GitHub

Repository navigation

gh-138158: Use the "data" tarfile extraction filter in Tools/ssl/multissltests.py - #138147

gh-138158: Use the "data" tarfile extraction filter in Tools/ssl/multissltests.py#138147picnixz merged 6 commits intopython:mainpython/cpython:mainfrom ParzivalHack:fix-multissl-path-traversalParzivalHack/cpython:fix-multissl-path-traversalCopy head branch name to clipboard

Conversation

ParzivalHack commented Aug 25, 2025 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

python-cla-bot Bot commented Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

AA-Turner left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app Bot commented Aug 26, 2025

Uh oh!

StanFromIreland commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ParzivalHack commented Aug 26, 2025

Uh oh!

bedevere-app Bot commented Aug 26, 2025

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app Bot commented Aug 26, 2025

Uh oh!

AA-Turner left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

picnixz commented Aug 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ParzivalHack commented Aug 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Aug 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ParzivalHack commented Aug 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Aug 30, 2025

Uh oh!

ParzivalHack commented Aug 30, 2025

Uh oh!

miss-islington-app Bot commented Aug 30, 2025

Uh oh!

bedevere-app Bot commented Aug 30, 2025

Uh oh!

bedevere-app Bot commented Aug 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gh-138158: Use the "data" tarfile extraction filter in Tools/ssl/multissltests.py#138147
picnixz merged 6 commits into
python:mainfrom
ParzivalHack:fix-multissl-path-traversal

ParzivalHack commented Aug 25, 2025 •
edited by bedevere-app Bot
Loading

python-cla-bot Bot commented Aug 25, 2025 •
edited
Loading

StanFromIreland commented Aug 26, 2025 •
edited
Loading

AA-Turner left a comment •
edited
Loading

picnixz commented Aug 30, 2025 •
edited
Loading

ParzivalHack commented Aug 30, 2025 •
edited
Loading

picnixz commented Aug 30, 2025 •
edited
Loading

ParzivalHack commented Aug 30, 2025 •
edited
Loading