Skip to content

tarfile hardlink fallback ignores custom extraction filter rejection via None #157265

Closed
Closed
tarfile hardlink fallback ignores custom extraction filter rejection via None#157265
Assignees
encukou
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@encukou
encukou
opened on Sep 10, 2026

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link.
For one of the calls, the return value is ignored. Instead, the member should be skipped if either call returns None.

Linked PRs

Activity

  1. encukou
    self-assigned this
    on Sep 10, 2026
  2. encukou
    added
    type-securityA security issue
    stdlibStandard Library Python modules in the Lib/ directory
    on Sep 10, 2026
  3. encukou
    added this to Tarfile issues 🗄️on Sep 10, 2026
  4. StanFromIreland
    added
    3.11only security fixes
    3.10 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    3.15bugs and security fixes
    3.16new features, bugs and security fixes
    on Sep 10, 2026
  5. encukou
    added 2 commits that reference this issue on Sep 11, 2026

    gh-157265: tarfile: Honor None result of filter for link fallbacks (G…

    fb2f0bb

    gh-157265: Adjust test for Windows (GH-157334)

    d9565e5
  6. clin1234
    added 2 commits that reference this issue on Sep 12, 2026

    pythongh-157265: tarfile: Honor None result of filter for link fallba…

    4cbdc6a

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    c94632a

  7. 2 remaining items

  8. encukou
    added 7 commits that reference this issue on Sep 14, 2026

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    c35210c

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    b4c75c0

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    f93473e

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    dd5fcbc

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    47c36b7

    pythongh-157265: Adjust test for Windows (pythonGH-157334)

    7ad7f71

    [3.13] gh-157265: tarfile: Honor None result of filter for link fallb…

    9c17bac
  9. Yhg1s
    added a commit that references this issue on Sep 30, 2026

    [3.12] gh-157265: tarfile: Honor None result of filter for link fallb…

    764fd0a
  10. pablogsal
    added 2 commits that reference this issue on Oct 1, 2026

    [3.10] gh-157265: tarfile: Honor None result of filter for link fallb…

    c1f106d

    [3.11] gh-157265: tarfile: Honor None result of filter for link fallb…

    2eb0c2f
  11. StanFromIreland
    added a commit that references this issue on Oct 1, 2026

    [3.14] gh-157265: tarfile: Honor None result of filter for link fallb…

    a491993
  12. hugovk
    added a commit that references this issue on Oct 1, 2026

    [3.15] gh-157265: tarfile: Honor None result of filter for link fallb…

    3105a34
  13. hugovk
    closed this as completedon Oct 1, 2026
  14. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Oct 1, 2026
  15. python
    deleted a comment from rajsingh09849-sudo on Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions