Staging
v0.5.1
https://github.com/python/cpython
Revision e866f33a48ee24e447fafd181f0da5f9584e0340 authored by Miss Skeleton (bot) on 21 October 2020, 05:29:44 UTC, committed by GitHub on 21 October 2020, 05:29:44 UTC

tarfile writes full path to FNAME field of GZIP format instead of just basename if user specified absolute path. Some archive viewers may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.

RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.

So tarfile must remove directory names from FNAME and write only basename of file.

Automerge-Triggered-By: @jaraco
(cherry picked from commit 22748a83d927d3da1beaed771be30887c42b2500)

Co-authored-by: Artem Bulgakov <ArtemSBulgakov@ya.ru>
1 parent 6443a8c
Raw File
Tip revision: e866f33a48ee24e447fafd181f0da5f9584e0340 authored by Miss Skeleton (bot) on 21 October 2020, 05:29:44 UTC
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
Tip revision: e866f33
.gitignore
#####
# First, rules intended to apply in all subdirectories.
# These contain no slash, or only a trailing slash.

*.cover
*.iml
*.o
*.a
*.so*
*.dylib
*.dll
*.orig
*.pyc
*.pyd
*.pyo
*.rej
*.swp
*~
*.gc??
*.profclang?
*.profraw
*.dyn
.gdb_history
.purify
__pycache__
.hg/
.svn/
.idea/
tags
TAGS
.vs/
.vscode/
gmon.out
.coverage
.mypy_cache/

*.exe
!Lib/distutils/command/*.exe

# Ignore core dumps... but not Tools/msi/core/ or the like.
core
!core/


#####
# Then, rules meant for a specific location relative to the repo root.
# These must contain a non-trailing slash (and may also have a trailing slash.)

Doc/build/
Doc/venv/
Doc/.venv/
Doc/env/
Doc/.env/
Include/pydtrace_probes.h
Lib/distutils/command/*.pdb
Lib/lib2to3/*.pickle
Lib/test/data/*
!Lib/test/data/README
/Makefile
/Makefile.pre
Misc/python.pc
Misc/python-embed.pc
Misc/python-config.sh
Modules/Setup.config
Modules/Setup.local
Modules/config.c
Modules/ld_so_aix
Programs/_freeze_importlib
Programs/_testembed
PC/python_nt*.h
PC/pythonnt_rc*.h
PC/*/*.exp
PC/*/*.lib
PC/*/*.bsc
PC/*/*.dll
PC/*/*.pdb
PC/*/*.user
PC/*/*.ncb
PC/*/*.suo
PC/*/Win32-temp-*
PC/*/x64-temp-*
PC/*/amd64
PCbuild/*.user
PCbuild/*.suo
PCbuild/*.*sdf
PCbuild/*-pgi
PCbuild/*-pgo
PCbuild/*.VC.db
PCbuild/*.VC.opendb
PCbuild/amd64/
PCbuild/arm32/
PCbuild/arm64/
PCbuild/obj/
PCbuild/win32/
/autom4te.cache
/build/
/config.cache
/config.log
/config.status
/config.status.lineno
/platform
/pybuilddir.txt
/pyconfig.h
/python-config
/python-config.py
/python.bat
/python-gdb.py
/python.exe-gdb.py
/reflog.txt
/coverage/
/externals/
/htmlcov/
Tools/msi/obj
Tools/ssl/amd64
Tools/ssl/win32

# Two-trick pony for OSX and other case insensitive file systems:
# Ignore ./python binary on Unix but still look into ./Python/ directory.
/python
!/Python/
back to top