mirror of
https://github.com/python/cpython.git
synced 2026-01-29 02:32:18 +00:00
Warn about possible risks when extracting untrusted archives.
This commit is contained in:
parent
39f1f45262
commit
b9ff669748
1 changed files with 10 additions and 0 deletions
|
|
@ -207,6 +207,12 @@ tar archive several times. Each archive member is represented by a
|
|||
problems: A directory's modification time is reset each time a file is
|
||||
created in it. And, if a directory's permissions do not allow writing,
|
||||
extracting files to it will fail.
|
||||
\begin{notice}[warning]
|
||||
Never extract archives from untrusted sources without prior inspection.
|
||||
It is possible that files are created outside of \var{path}, e.g. members
|
||||
that have absolute filenames starting with \code{"/"} or filenames with
|
||||
two dots \code{".."}.
|
||||
\end{notice}
|
||||
\versionadded{2.5}
|
||||
\end{methoddesc}
|
||||
|
||||
|
|
@ -221,6 +227,10 @@ tar archive several times. Each archive member is represented by a
|
|||
archive there are some issues you must take care of yourself. See the
|
||||
description for \method{extractall()} above.
|
||||
\end{notice}
|
||||
|
||||
\begin{notice}[warning]
|
||||
See the warning for \method{extractall()}.
|
||||
\end{notice}
|
||||
\end{methoddesc}
|
||||
|
||||
\begin{methoddesc}{extractfile}{member}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue