Skip to content

tarfile: Do not write full path in FNAME field #85488

Closed
Closed
tarfile: Do not write full path in FNAME field#85488
Labels
3.10 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

Description

@ArtemSBulgakov
ArtemSBulgakov
mannequin
opened on Jul 16, 2020
BPO 41316
Nosy @gustaebel, @ethanfurman, @eamanu, @miss-islington, @ArtemSBulgakov
PRs
  • bpo-41316: Make tarfile follow specs for FNAME #21511
  • [3.9] bpo-41316: Make tarfile follow specs for FNAME (GH-21511) #22140
  • [3.8] bpo-41316: Make tarfile follow specs for FNAME (GH-21511) #22141
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-10-21.08:10:09.115>
created_at = <Date 2020-07-16.18:37:23.017>
labels = ['3.8', 'type-bug', 'library', '3.9', '3.10']
title = 'tarfile: Do not write full path in FNAME field'
updated_at = <Date 2020-10-21.08:10:09.114>
user = 'https://github.com/ArtemSBulgakov'

    bugs.python.org fields:

    activity = <Date 2020-10-21.08:10:09.114>
actor = 'methane'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-21.08:10:09.115>
closer = 'methane'
components = ['Library (Lib)']
creation = <Date 2020-07-16.18:37:23.017>
creator = 'ArtemSBulgakov'
dependencies = []
files = []
hgrepos = []
issue_num = 41316
keywords = ['patch']
message_count = 6.0
messages = ['373759', '373790', '373798', '376515', '379194', '379195']
nosy_count = 5.0
nosy_names = ['lars.gustaebel', 'ethan.furman', 'eamanu', 'miss-islington', 'ArtemSBulgakov']
pr_nums = ['21511', '22140', '22141']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue41316'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

    Activity

    1. ArtemSBulgakov commented on Jul 16, 2020

      @ArtemSBulgakov
      ArtemSBulgakovmannequin
      on Jul 16, 2020
      MannequinAuthor

      tarfile sets FNAME field to the path given by user: Lib/tarfile.py:424

      It writes full path instead of just basename if user specified absolute path. Some archive viewer apps like 7-Zip may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.

      You can reproduce this by running below lines in Python interpreter. Tested on Windows and Linux.

      Python 3.8.2 (default, Apr 27 2020, 15:53:34)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> import tarfile
>>> open("somefile.txt", "w").write("sometext")
8
>>> tar = tarfile.open("/home/bulgakovas/file.tar.gz", "w|gz")
>>> tar.add("somefile.txt")
>>> tar.close()
>>> open("file.tar.gz", "rb").read()[:50]
b'\x1f\x8b\x08\x08cE\x10_\x02\xff/home/bulgakovas/file.tar\x00\xed\xd3M\n\xc20\x10\x86\xe1\xac=EO\x90'

      You can see full path to file.tar (/home/bulgakovas/file.tar) as FNAME field. If you will write just tarfile.open("file.tar.gz", "w|gz"), FNAME will be equal to file.tar.

      RFC1952 says about FNAME:
      This is the original name of the file being compressed, with any directory components removed.

      So tarfile must remove directory names from FNAME and write only basename of file.

    2. ArtemSBulgakov
      added
      3.7 (EOL)end of life
      3.10 (EOL)end of life
      3.8 (EOL)end of life
      3.9 (EOL)end of life
      stdlibStandard Library Python modules in the Lib/ directory
      type-bugAn unexpected behavior, bug, or error
      on Jul 16, 2020

    3. eamanu commented on Jul 17, 2020

      @eamanu
      eamanumannequin
      on Jul 17, 2020
      Mannequin

      Hi,

      If I understand correctly, the name that you are using into the tar
      is the basename of the file. I didn't test it yet, but this PR will
      remove the possibility to create a file into the tar using the
      source tree folder?

      Maybe we can think about implement a parameter seems like arcname
      on Zipfile?

      What about that?

      Cheers!

    4. ArtemSBulgakov commented on Jul 17, 2020

      @ArtemSBulgakov
      ArtemSBulgakovmannequin
      on Jul 17, 2020
      MannequinAuthor

      Hi. My PR doesn't remove the possibility to add tree into tar file. It only fixes header for GZIP compression. Any data after this header is not affected.

      You can test it by creating two archives with the same data but one with my patch and the second without. All bytes after header are equal.

    5. miss-islington commented on Sep 7, 2020

      @miss-islington
      miss-islington
      on Sep 7, 2020
      Contributor

      New changeset 22748a8 by Artem Bulgakov in branch 'master':
      bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
      22748a8

    6. miss-islington commented on Oct 21, 2020

      @miss-islington
      miss-islington
      on Oct 21, 2020
      Contributor

      New changeset 7917170 by Miss Skeleton (bot) in branch '3.9':
      bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
      7917170

    7. miss-islington commented on Oct 21, 2020

      @miss-islington
      miss-islington
      on Oct 21, 2020
      Contributor

      New changeset e866f33 by Miss Skeleton (bot) in branch '3.8':
      bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
      e866f33

    8. methane
      removed
      3.7 (EOL)end of life
      on Oct 21, 2020
    9. methane
      closed this as completedon Oct 21, 2020
    10. methane
      removed
      3.7 (EOL)end of life
      on Oct 21, 2020
    11. methane
      closed this as completedon Oct 21, 2020
    12. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions