cpython: 4d1948689ee1 (original) (raw)

--- a/Doc/library/zipfile.rst +++ b/Doc/library/zipfile.rst @@ -242,6 +242,16 @@ ZipFile Objects .. versionadded:: 2.6

• .. note:: +

•  If a member filename is an absolute path, a drive/UNC sharepoint and[](#l1.9)

•  leading (back)slashes will be stripped, e.g.: ``///foo/bar`` becomes[](#l1.10)

•  ``foo/bar`` on Unix, and ``С:\foo\bar`` becomes ``foo\bar`` on Windows.[](#l1.11)

•  And all ``".."`` components in a member filename will be removed, e.g.:[](#l1.12)

•  ``../../foo../../ba..r`` becomes ``foo../ba..r``.  On Windows illegal[](#l1.13)

•  characters (``:``, ``<``, ``>``, ``|``, ``"``, ``?``, and ``*``)[](#l1.14)

•  replaced by underscore (``_``).[](#l1.15)

+ .. method:: ZipFile.read(name[, pwd])

--- a/Lib/test/test_zipfile.py +++ b/Lib/test/test_zipfile.py @@ -26,7 +26,7 @@ FIXEDTEST_SIZE = 1000 SMALL_TEST_DATA = [('_ziptest1', '1q2w3e4r5t'), ('ziptest2dir/_ziptest2', 'qawsedrftg'),

•               ('/ziptest2dir/ziptest3dir/_ziptest3', 'azsxdcfvgb'),[](#l2.7)

•               ('ziptest2dir/ziptest3dir/_ziptest3', 'azsxdcfvgb'),[](#l2.8)
                ('ziptest2dir/ziptest3dir/ziptest4dir/_ziptest3', '6y7u8i9o0p')][](#l2.9)

@@ -391,10 +391,7 @@ class TestsWithSourceFile(unittest.TestC writtenfile = zipfp.extract(fpath) # make sure it was written to the right place

•            if os.path.isabs(fpath):[](#l2.16)

•                correctfile = os.path.join(os.getcwd(), fpath[1:])[](#l2.17)

•            else:[](#l2.18)

•                correctfile = os.path.join(os.getcwd(), fpath)[](#l2.19)

•            correctfile = os.path.join(os.getcwd(), fpath)[](#l2.20)
             correctfile = os.path.normpath(correctfile)[](#l2.21)

self.assertEqual(writtenfile, correctfile) @@ -414,10 +411,7 @@ class TestsWithSourceFile(unittest.TestC with zipfile.ZipFile(TESTFN2, "r") as zipfp: zipfp.extractall() for fpath, fdata in SMALL_TEST_DATA:

•            if os.path.isabs(fpath):[](#l2.28)

•                outfile = os.path.join(os.getcwd(), fpath[1:])[](#l2.29)

•            else:[](#l2.30)

•                outfile = os.path.join(os.getcwd(), fpath)[](#l2.31)

•            outfile = os.path.join(os.getcwd(), fpath)[](#l2.32)

self.assertEqual(fdata, open(outfile, "rb").read()) os.remove(outfile) @@ -425,6 +419,80 @@ class TestsWithSourceFile(unittest.TestC # remove the test file subdirectories shutil.rmtree(os.path.join(os.getcwd(), 'ziptest2dir'))

• def check_file(self, filename, content):

•    self.assertTrue(os.path.isfile(filename))[](#l2.41)

•    with open(filename, 'rb') as f:[](#l2.42)

•        self.assertEqual(f.read(), content)[](#l2.43)

+

• def test_extract_hackers_arcnames(self):

•    hacknames = [[](#l2.46)

•        ('../foo/bar', 'foo/bar'),[](#l2.47)

•        ('foo/../bar', 'foo/bar'),[](#l2.48)

•        ('foo/../../bar', 'foo/bar'),[](#l2.49)

•        ('foo/bar/..', 'foo/bar'),[](#l2.50)

•        ('./../foo/bar', 'foo/bar'),[](#l2.51)

•        ('/foo/bar', 'foo/bar'),[](#l2.52)

•        ('/foo/../bar', 'foo/bar'),[](#l2.53)

•        ('/foo/../../bar', 'foo/bar'),[](#l2.54)

•        ('//foo/bar', 'foo/bar'),[](#l2.55)

•        ('../../foo../../ba..r', 'foo../ba..r'),[](#l2.56)

•    ][](#l2.57)

•    if os.path.sep == '\\':[](#l2.58)

•        hacknames.extend([[](#l2.59)

•            (r'..\foo\bar', 'foo/bar'),[](#l2.60)

•            (r'..\/foo\/bar', 'foo/bar'),[](#l2.61)

•            (r'foo/\..\/bar', 'foo/bar'),[](#l2.62)

•            (r'foo\/../\bar', 'foo/bar'),[](#l2.63)

•            (r'C:foo/bar', 'foo/bar'),[](#l2.64)

•            (r'C:/foo/bar', 'foo/bar'),[](#l2.65)

•            (r'C://foo/bar', 'foo/bar'),[](#l2.66)

•            (r'C:\foo\bar', 'foo/bar'),[](#l2.67)

•            (r'//conky/mountpoint/foo/bar', 'foo/bar'),[](#l2.68)

•            (r'\\conky\mountpoint\foo\bar', 'foo/bar'),[](#l2.69)

•            (r'///conky/mountpoint/foo/bar', 'conky/mountpoint/foo/bar'),[](#l2.70)

•            (r'\\\conky\mountpoint\foo\bar', 'conky/mountpoint/foo/bar'),[](#l2.71)

•            (r'//conky//mountpoint/foo/bar', 'conky/mountpoint/foo/bar'),[](#l2.72)

•            (r'\\conky\\mountpoint\foo\bar', 'conky/mountpoint/foo/bar'),[](#l2.73)

•            (r'//?/C:/foo/bar', 'foo/bar'),[](#l2.74)

•            (r'\\?\C:\foo\bar', 'foo/bar'),[](#l2.75)

•            (r'C:/../C:/foo/bar', 'C_/foo/bar'),[](#l2.76)

•            (r'a:b\c<d>e|f"g?h*i', 'b/c_d_e_f_g_h_i'),[](#l2.77)

•        ])[](#l2.78)

+

•    for arcname, fixedname in hacknames:[](#l2.80)

•        content = b'foobar' + arcname.encode()[](#l2.81)

•        with zipfile.ZipFile(TESTFN2, 'w', zipfile.ZIP_STORED) as zipfp:[](#l2.82)

•            zipfp.writestr(arcname, content)[](#l2.83)

+

•        targetpath = os.path.join('target', 'subdir', 'subsub')[](#l2.85)

•        correctfile = os.path.join(targetpath, *fixedname.split('/'))[](#l2.86)

+

•        with zipfile.ZipFile(TESTFN2, 'r') as zipfp:[](#l2.88)

•            writtenfile = zipfp.extract(arcname, targetpath)[](#l2.89)

•            self.assertEqual(writtenfile, correctfile)[](#l2.90)

•        self.check_file(correctfile, content)[](#l2.91)

•        shutil.rmtree('target')[](#l2.92)

+

•        with zipfile.ZipFile(TESTFN2, 'r') as zipfp:[](#l2.94)

•            zipfp.extractall(targetpath)[](#l2.95)

•        self.check_file(correctfile, content)[](#l2.96)

•        shutil.rmtree('target')[](#l2.97)

+

•        correctfile = os.path.join(os.getcwd(), *fixedname.split('/'))[](#l2.99)

+

•        with zipfile.ZipFile(TESTFN2, 'r') as zipfp:[](#l2.101)

•            writtenfile = zipfp.extract(arcname)[](#l2.102)

•            self.assertEqual(writtenfile, correctfile)[](#l2.103)

•        self.check_file(correctfile, content)[](#l2.104)

•        shutil.rmtree(fixedname.split('/')[0])[](#l2.105)

+

•        with zipfile.ZipFile(TESTFN2, 'r') as zipfp:[](#l2.107)

•            zipfp.extractall()[](#l2.108)

•        self.check_file(correctfile, content)[](#l2.109)

•        shutil.rmtree(fixedname.split('/')[0])[](#l2.110)

+

•        os.remove(TESTFN2)[](#l2.112)

+ def test_writestr_compression(self): zipfp = zipfile.ZipFile(TESTFN2, "w") zipfp.writestr("a.txt", "hello world", compress_type=zipfile.ZIP_STORED)

--- a/Lib/zipfile.py +++ b/Lib/zipfile.py @@ -1040,17 +1040,22 @@ class ZipFile(object): """ # build the destination pathname, replacing # forward slashes to platform specific separators.

•    # Strip trailing path separator, unless it represents the root.[](#l3.7)

•    if (targetpath[-1:] in (os.path.sep, os.path.altsep)[](#l3.8)

•        and len(os.path.splitdrive(targetpath)[1]) > 1):[](#l3.9)

•        targetpath = targetpath[:-1][](#l3.10)

•    arcname = member.filename.replace('/', os.path.sep)[](#l3.11)

•    # don't include leading "/" from file name if present[](#l3.13)

•    if member.filename[0] == '/':[](#l3.14)

•        targetpath = os.path.join(targetpath, member.filename[1:])[](#l3.15)

•    else:[](#l3.16)

•        targetpath = os.path.join(targetpath, member.filename)[](#l3.17)

•    if os.path.altsep:[](#l3.18)

•        arcname = arcname.replace(os.path.altsep, os.path.sep)[](#l3.19)

•    # interpret absolute pathname as relative, remove drive letter or[](#l3.20)

•    # UNC path, redundant separators, "." and ".." components.[](#l3.21)

•    arcname = os.path.splitdrive(arcname)[1][](#l3.22)

•    arcname = os.path.sep.join(x for x in arcname.split(os.path.sep)[](#l3.23)

•                if x not in ('', os.path.curdir, os.path.pardir))[](#l3.24)

•    # filter illegal characters on Windows[](#l3.25)

•    if os.path.sep == '\\':[](#l3.26)

•        illegal = ':<>|"?*'[](#l3.27)

•        table = str.maketrans(illegal, '_' * len(illegal))[](#l3.28)

•        arcname = arcname.translate(table)[](#l3.29)

•    targetpath = os.path.join(targetpath, arcname)[](#l3.31)
     targetpath = os.path.normpath(targetpath)[](#l3.32)

# Create all upper directories if necessary.

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -202,6 +202,9 @@ Core and Builtins Library ------- +- Issue #6972: The zipfile module no longer overwrites files outside of

• its destination path when extracting malicious zip files. +

• Issue #17049: Localized calendar methods now return unicode if a locale includes an encoding and the result string contains month or weekday (was regression from Python 2.6).