Repository navigation
tarfile: Do not write full path in FNAME field #85488
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2020-10-21.08:10:09.115>
created_at = <Date 2020-07-16.18:37:23.017>
labels = ['3.8', 'type-bug', 'library', '3.9', '3.10']
title = 'tarfile: Do not write full path in FNAME field'
updated_at = <Date 2020-10-21.08:10:09.114>
user = 'https://github.com/ArtemSBulgakov'bugs.python.org fields:
activity = <Date 2020-10-21.08:10:09.114>
actor = 'methane'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-21.08:10:09.115>
closer = 'methane'
components = ['Library (Lib)']
creation = <Date 2020-07-16.18:37:23.017>
creator = 'ArtemSBulgakov'
dependencies = []
files = []
hgrepos = []
issue_num = 41316
keywords = ['patch']
message_count = 6.0
messages = ['373759', '373790', '373798', '376515', '379194', '379195']
nosy_count = 5.0
nosy_names = ['lars.gustaebel', 'ethan.furman', 'eamanu', 'miss-islington', 'ArtemSBulgakov']
pr_nums = ['21511', '22140', '22141']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue41316'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
Activity
ArtemSBulgakov commentedon Jul 16, 2020
tarfile sets FNAME field to the path given by user: Lib/tarfile.py:424
It writes full path instead of just basename if user specified absolute path. Some archive viewer apps like 7-Zip may process file incorrectly. Also it creates security issue because anyone can know structure of directories on system and know username or other personal information.
You can reproduce this by running below lines in Python interpreter. Tested on Windows and Linux.
You can see full path to file.tar (/home/bulgakovas/file.tar) as FNAME field. If you will write just tarfile.open("file.tar.gz", "w|gz"), FNAME will be equal to file.tar.
RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory components removed.
So tarfile must remove directory names from FNAME and write only basename of file.
eamanu commentedon Jul 17, 2020
Hi,
If I understand correctly, the name that you are using into the tar
is the basename of the file. I didn't test it yet, but this PR will
remove the possibility to create a file into the tar using the
source tree folder?
Maybe we can think about implement a parameter seems like arcname
on Zipfile?
What about that?
Cheers!
ArtemSBulgakov commentedon Jul 17, 2020
Hi. My PR doesn't remove the possibility to add tree into tar file. It only fixes header for GZIP compression. Any data after this header is not affected.
You can test it by creating two archives with the same data but one with my patch and the second without. All bytes after header are equal.
miss-islington commentedon Sep 7, 2020
New changeset 22748a8 by Artem Bulgakov in branch 'master':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
22748a8
miss-islington commentedon Oct 21, 2020
New changeset 7917170 by Miss Skeleton (bot) in branch '3.9':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
7917170
miss-islington commentedon Oct 21, 2020
New changeset e866f33 by Miss Skeleton (bot) in branch '3.8':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
e866f33