Repository navigation
Docs for pkgutil.get_data inconsistent with semantics #69517
Description
| BPO | 25330 |
|---|---|
| Nosy | @Yhg1s, @anntzer, @pganssle |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2015-10-07.03:06:14.291>
labels = ['3.7', 'library']
title = 'Docs for pkgutil.get_data inconsistent with semantics'
updated_at = <Date 2020-09-11.22:09:18.404>
user = 'https://github.com/anntzer'bugs.python.org fields:
activity = <Date 2020-09-11.22:09:18.404>
actor = 'brett.cannon'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2015-10-07.03:06:14.291>
creator = 'Antony.Lee'
dependencies = []
files = []
hgrepos = []
issue_num = 25330
keywords = []
message_count = 6.0
messages = ['252450', '252480', '263243', '263268', '310777', '310879']
nosy_count = 4.0
nosy_names = ['twouters', 'Antony.Lee', 'WGH', 'p-ganssle']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = None
url = 'https://bugs.python.org/issue25330'
versions = ['Python 3.6', 'Python 3.7']
Activity
anntzer commentedon Oct 7, 2015
The docs of pkgutil.get_data say "The resource argument should be in the form of a relative filename, using / as the path separator. The parent directory name .. is not allowed, and nor is a rooted name (starting with a /)."
In fact (on Python 3.5 at least):
People who actually thought about the implications of get_data/zipimport/etc. can decide whether to remove this functionality or to update the docs, I'm just reporting it.
Also, it would be nice if get_data gained a "text mode" (i.e. returning str instead of bytes and with support for universal newlines).
brettcannon commentedon Oct 7, 2015
Changing this to be a single issue about the difference between the docs and the semantics of pkgutil.
The feature request can be made into a separate issue, but there are plans to replace the API with a more stringently defined one in importlib.
[-]Two issues with pkgutil.get_data[/-][+]Docs for pkgutil.get_data inconsistent with semantics[/+]WGH commentedon Apr 12, 2016
I think it can even be considered a security bug. A classic path traversal. The fact that documentation falsely suggests that there's no such vulnerability is clearly not helping.
Python 2.7 is affected as well, by the way.
brettcannon commentedon Apr 12, 2016
This can't change in Python 2.7 because of backwards-compatibility. And I would argue this isn't a serious security risk as pkgutil.get_data() typically works with string constants and values provided by the library and not user-provided values. This is basically the same as taking a value for open() and has the same risks.
pganssle commentedon Jan 26, 2018
I'm not sure if this warrants a separate issue, but I also notice this in the documentation:
But in reality this seems to raise a FileNotFoundError:
>>> import pkgutil >>> data = pkgutil.get_data('dateutil.zoneinfo', 'dateutil-zoneinfo.tar.gz') >>> len(data) 139671 >>> data = pkgutil.get_data('dateutil.zoneinfo', 'foo-bar.tar.gz') FileNotFoundError: [Errno 2] No such file or directory: '/usr/lib/python3.6/site-packages/dateutil/zoneinfo/foo-bar.tar.gz'Am I misunderstanding the documentation, or should the failure mode be corrected to specify that it raises an error?
brettcannon commentedon Jan 27, 2018
Notice that the returning of None only has to do with searching for the *package*, not the *data file*. So I think the docs are still correct according to your example, Paul.
methane commentedon Sep 29, 2026
fixed by #148197