Skip to content

Commit faf91be

Browse files
encukoumcepl
authored andcommitted
[CVE-2026-4360] Pass filter_function to TarFile._extract_one() during .extract()
This patch ensures TarFile.extract() properly passes the filter parameter to _extract_one() when fallback extraction occurs for missing hardlink targets. Fixes: bsc#1269959 (CVE-2026-4360) Fixes: gh#python#151987 From-PR: gh#python/cpython!151988 Patch: CVE-2026-4360-filter_function-TarFile-extractone.patch
1 parent 3bb8fcf commit faf91be

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

‎Lib/tarfile.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2346,7 +2346,8 @@ def extract(self, member, path="", set_attrs=True, *, numeric_owner=False,
23462346
tarinfo, unfiltered = self._get_extract_tarinfo(
23472347
member, filter_function, path)
23482348
if tarinfo is not None:
2349-
self._extract_one(tarinfo, path, set_attrs, numeric_owner)
2349+
self._extract_one(tarinfo, path, set_attrs, numeric_owner,
2350+
filter_function=filter_function)
23502351

23512352
def _get_extract_tarinfo(self, member, filter_function, path):
23522353
"""Get (filtered, unfiltered) TarInfos from *member*

0 commit comments

Comments
 (0)