uranusjr commented on code in PR #73015: URL: https://github.com/apache/airflow/pull/73015#discussion_r4410417172
########## providers/amazon/src/airflow/providers/amazon/aws/bundles/s3.py: ########## @@ -17,14 +17,40 @@ from __future__ import annotations import os +import shutil +import tarfile +import tempfile from pathlib import Path import structlog from airflow.dag_processing.bundles.base import BaseDagBundle from airflow.providers.amazon.aws.hooks.base_aws import AwsBaseHook from airflow.providers.amazon.aws.hooks.s3 import S3Hook -from airflow.providers.common.compat.sdk import AirflowException +from airflow.providers.common.compat.sdk import AirflowException, AirflowNotFoundException + + +def _extract_archive(archive_path: Path, unpack_dir: Path) -> None: + """Unpack a bundle archive without writing outside ``unpack_dir``.""" + with tarfile.open(archive_path, "r:*") as tar: + # filter="data" arrived in Python 3.11.4. 3.11.0-3.11.3 still have to reject + # the same escapes by hand. + if hasattr(tarfile, "data_filter"): Review Comment: With 3.11 already in security-only mode and being dropped next year, I wonder if it’s worthwhile to implement a fallback at all. It would be acceptable IMO to simply gate this feature if `filter="data"` is not available. The current fallback implementation already has gaps compared to stdlib regarding symlinks etc. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
