You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In jaraco/zipp#117, I learned that the current implementation of is_symlink might have a security risk if a user is relying on it to ensure that a zipfile has no symlinks before using another tool to extract it.
zipp 3.19.0 adds an implementation for Path.is_symlink to alleviate this risk.
CPython should adopt this change as well, possibly as a security fix.
The is_symlink was added in Python 3.12 (#102018) (note the backports of that PR only included one bugfix), so this change can be backported to Python 3.12 as a bugfix (no need to flag as a security fix).
Activity
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0).
jaraco commentedon May 27, 2024
The
is_symlinkwas added in Python 3.12 (#102018) (note the backports of that PR only included one bugfix), so this change can be backported to Python 3.12 as a bugfix (no need to flag as a security fix).pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0).
gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (#119591)
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…
[3.13] gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (G…
pythongh-119588: Update docs to reflect decision to include the chang…
gh-119588: Update docs to reflect decision to include the change with…
pythongh-119588: Update docs to reflect decision to include the chang…
[3.13] gh-119588: Update docs to reflect decision to include the chan…
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…
pythongh-119588: Update docs to reflect decision to include the chang…
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…
pythongh-119588: Update docs to reflect decision to include the chang…
pythongh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (py…
pythongh-119588: Update docs to reflect decision to include the chang…
hugovk commentedon Aug 8, 2024
Triage: closing because the PR has been merged, please re-open if still needed. Thanks!