Skip to content

gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction #146588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Shrey-N wants to merge 8 commits into from
Closed

gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction #146588

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b3d178a
Update shutil.py
Shrey-N Mar 29, 2026
494d2b1
Implement Windows ZIP traversal test in test_shutil
Shrey-N Mar 29, 2026
d185905
Clarify comments in test_unpack_zipfile_traversal_windows_drive
Shrey-N Mar 29, 2026
958ec29
📜🤖 Added by blurb_it.
blurb-it[bot] Mar 29, 2026
b0f0dc8
Remove unnecessary blank lines in test_shutil.py
Shrey-N Mar 29, 2026
8ce8bc2
Clean up whitespace in _unpack_zipfile function
Shrey-N Mar 29, 2026
cfb3d0f
Update shutil.py
Shrey-N Mar 29, 2026
678fc3d
Update shutil.py
Shrey-N Mar 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
📜🤖 Added by blurb_it.
  • Loading branch information
@blurb-it
blurb-it[bot] authored Mar 29, 2026
commit 958ec29b135fec8115fec08f708ff0b2a29f1730
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Security/2026-03-29-08-14-09.gh-issue-146581.81t9a4.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fix a directory traversal vulnerability in shutil.unpack_archive for ZIP files on Windows by refactoring _unpack_zipfile to use zipfile.ZipFile.extractall. This leverages the built in, hardened path sanitization in the zipfile module to safely handle drive prefixed paths. Patch by Shrey Naithani.
Loading