Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve handling of malformed zip files #119

Closed
jaraco opened this issue May 31, 2024 · 0 comments · Fixed by #120
Closed

Improve handling of malformed zip files #119

jaraco opened this issue May 31, 2024 · 0 comments · Fixed by #120

Comments

@jaraco
Copy link
Owner

jaraco commented May 31, 2024 •
edited
Loading

Currently, Path has no special handling for zip files with illegal and malformed names. The handling for such paths in zipfile.ZipFile is only handled during extraction, but is relevant for traversal and inspection and lack of such handling can create unexpected behaviors such as infinite loops.

As reported at huntr.com.
@jaraco jaraco mentioned this issue May 31, 2024
Merged
@igorgiumellizup igorgiumellizup mentioned this issue Jul 12, 2024
Closed
@jaraco jaraco mentioned this issue Aug 11, 2024
Closed
jaraco added a commit to jaraco/cpython that referenced this issue Aug 11, 2024
@jaraco
pythongh-122905: Sanitize names in zipfile.Path.
1e15a83 
Closes python#122905; Ported from zipp 3.19.1; ref jaraco/zipp#119.
@jaraco jaraco mentioned this issue Aug 11, 2024
Merged
jaraco added a commit to python/cpython that referenced this issue Aug 11, 2024
@jaraco
gh-122905: Sanitize names in zipfile.Path. (#122906)
9cd0326 
Ported from zipp 3.19.1; ref jaraco/zipp#119.
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 11, 2024
@jaraco @miss-islington
pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)
d6402c8 
Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
@miss-islington miss-islington mentioned this issue Aug 11, 2024
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Aug 11, 2024
@jaraco @miss-islington
pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)
ee9f405 
Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
@miss-islington miss-islington mentioned this issue Aug 11, 2024
Merged
jaraco added a commit to jaraco/cpython that referenced this issue Aug 12, 2024
@jaraco
pythongh-122905: Sanitize names in zipfile.Path. (python#122906)
0d480f2 
Ported from zipp 3.19.1; ref jaraco/zipp#119.

(cherry picked from commit 9cd0326)
jaraco added a commit to jaraco/cpython that referenced this issue Aug 12, 2024
@jaraco
[3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906
ed03fe9 
)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
pablogsal pushed a commit to python/cpython that referenced this issue Aug 19, 2024
@jaraco
[3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122925)
795f259 
* gh-122905: Sanitize names in zipfile.Path. (#122906)

Ported from zipp 3.19.1; ref jaraco/zipp#119.

(cherry picked from commit 9cd0326)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit to jaraco/cpython that referenced this issue Aug 19, 2024
@jaraco
[3.10] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pytho…
d82745e 
…nGH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit to jaraco/cpython that referenced this issue Aug 19, 2024
@jaraco
[3.9] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (python…
8973dbf 
…GH-122906) (pythonGH-122925)

* pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
blhsing pushed a commit to blhsing/cpython that referenced this issue Aug 22, 2024
@jaraco @blhsing
pythongh-122905: Sanitize names in zipfile.Path. (python#122906)
c0d9e10 
Ported from zipp 3.19.1; ref jaraco/zipp#119.
pablogsal pushed a commit to python/cpython that referenced this issue Aug 22, 2024
@jaraco
[3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#123160)
e0264a6 
[3.10] [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (GH-122925)

* gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd0326)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd0326)

(cherry picked from commit 795f259)
jaraco added a commit that referenced this issue Aug 26, 2024
@jaraco
Address infinite loop when zipfile begins with more than one leading …
9bee3b9 
…slash.

Alternate and more surgical fix for #119. Ref python/cpython#123270
jaraco added a commit that referenced this issue Aug 26, 2024
@jaraco
Address infinite loop when zipfile begins with more than one leading …
4aab5e4 
…slash.

Alternate and more surgical fix for #119. Ref python/cpython#123270
jaraco added a commit that referenced this issue Aug 26, 2024
@jaraco
Address infinite loop when zipfile begins with more than one leading …
f89b93f 
…slash.

Alternate and more surgical fix for #119. Ref python/cpython#123270
eclipse-oniro-oh-bot pushed a commit to eclipse-oniro-mirrors/third_party_python that referenced this issue Aug 30, 2024
@jaraco
[3.10] [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) …
f351898 
…(GH-122925)

* gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.

(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)

* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906)

Ported from zipp 3.19.1; ref jaraco/zippGH-119.
(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932)

(cherry picked from commit 795f2597a4be988e2bb19b69ff9958e981cb894e)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

Signed-off-by: luming <luming29@huawei.com>
@michael12345202 michael12345202 mentioned this issue Sep 19, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Sanitize malformed paths jaraco/zipp
1 participant
@jaraco