Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement zipfile.Path.is_symlink #119588

Closed
jaraco opened this issue May 27, 2024 · 2 comments
Closed

Implement zipfile.Path.is_symlink #119588

jaraco opened this issue May 27, 2024 · 2 comments

Comments

@jaraco
Copy link
Member

jaraco commented May 27, 2024

In jaraco/zipp#117, I learned that the current implementation of is_symlink might have a security risk if a user is relying on it to ensure that a zipfile has no symlinks before using another tool to extract it.

zipp 3.19.0 adds an implementation for Path.is_symlink to alleviate this risk.

CPython should adopt this change as well, possibly as a security fix.

Linked PRs

jaraco added a commit to jaraco/cpython that referenced this issue May 27, 2024
@jaraco
Copy link
Member Author

jaraco commented May 27, 2024

The is_symlink was added in Python 3.12 (#102018) (note the backports of that PR only included one bugfix), so this change can be backported to Python 3.12 as a bugfix (no need to flag as a security fix).

jaraco added a commit to jaraco/cpython that referenced this issue May 27, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jun 3, 2024
…thonGH-119591)

(cherry picked from commit 42a34dd)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit that referenced this issue Jun 4, 2024
…H-119591) (#119985)

gh-119588: Implement zipfile.Path.is_symlink (zipp 3.19.0). (GH-119591)
(cherry picked from commit 42a34dd)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit to jaraco/cpython that referenced this issue Jun 4, 2024
jaraco added a commit that referenced this issue Jun 4, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jun 4, 2024
…e with Python 3.13 and not 3.12. (pythonGH-120043)

(cherry picked from commit 4dcd91c)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
jaraco added a commit that referenced this issue Jun 4, 2024
…ge with Python 3.13 and not 3.12. (GH-120043) (#120046)

gh-119588: Update docs to reflect decision to include the change with Python 3.13 and not 3.12. (GH-120043)
(cherry picked from commit 4dcd91c)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
barneygale pushed a commit to barneygale/cpython that referenced this issue Jun 5, 2024
noahbkim pushed a commit to hudson-trading/cpython that referenced this issue Jul 11, 2024
estyxx pushed a commit to estyxx/cpython that referenced this issue Jul 17, 2024
@hugovk
Copy link
Member

hugovk commented Aug 8, 2024

Triage: closing because the PR has been merged, please re-open if still needed. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

No branches or pull requests

2 participants