Skip to content

gh-156002: Keep reading through third-party zipfile decompressors #157180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
encukou merged 5 commits into from
Sep 10, 2026
Merged

gh-156002: Keep reading through third-party zipfile decompressors #157180

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
77c81d7
gh-156002: Keep reading through third-party zipfile decompressors
rasmusfaber Sep 8, 2026
3c2b602
Rewind in the third-party decompressor test; wrap two long lines
rasmusfaber Sep 8, 2026
26d3267
Rename tests; check that the "compression" happened
encukou Sep 9, 2026
2146494
Make LZMADecompressor.needs_input public; simplify implementation
encukou Sep 9, 2026
1431f15
Fix typos and other nits.
rasmusfaber Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Fix typos and other nits.
  • Loading branch information
@rasmusfaber
rasmusfaber committed Sep 9, 2026
commit 1431f15a21e2bd4b4e114beef55f1ff34fab2dc0
8 changes: 4 additions & 4 deletions Lib/test/test_zipfile/test_core.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4922,8 +4922,8 @@ class MonkeypatchedDecompressorTests(unittest.TestCase):
# Some third-party projects monkey-patch _get_decompressor() to add
# additional compression schemes. This can break at any time as the
# internal compressor objects change.
# To protect users, we try to keep this case working (see ).
# See also: GH-156002 and GH-113756.
# To protect users, we try to keep this case working.
# See also: GH-156002 and GH-113767.
COMPRESSION = 99

class Compressor:
Expand All @@ -4935,7 +4935,7 @@ def flush(self):
return b''

class Decompressor:
"""Decmpressor with only the 3.3+ BZ2Decompressor API"""
"""Decompressor with only the 3.3+ BZ2Decompressor API"""
eof = False

def decompress(self, data):
Expand Down Expand Up @@ -4974,7 +4974,7 @@ def test_roundtrip_monkeypatched_decompressor(self):
zf.writestr("member", data)
self.assertIn(data.swapcase(), buf.getvalue())
with (ignore_warnings(category=DeprecationWarning,
message='.*two argumentzs.*'),
message='.*two arguments.*'),
zipfile.ZipFile(io.BytesIO(buf.getvalue())) as zf):
self.assertEqual(zf.read("member"), data)
with zf.open("member") as f:
Expand Down
2 changes: 1 addition & 1 deletion Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
:mod:`zipfile` again reads members through a third-party decompressor
installed by monkey-patching the private ``_get_decompressor()`` to return an
object that only implements old BZ2Decompressor API from Python 3.3.
Calling to decompress() with one argument is deprecated.
Calling decompress() with one argument is deprecated.
Note that decompressors without ``needs_input`` and two-argument
``decompress()`` are vulnerable to :cve:`2026-15310`.
Loading