[issue41316] tarfile: Do not write full path in FNAME field

[Inada Naoki]

Change by Inada Naoki :


--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed
versions:  -Python 3.5, Python 3.6, Python 3.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[miss-islington]

miss-islington  added the comment:


New changeset e866f33a48ee24e447fafd181f0da5f9584e0340 by Miss Skeleton (bot) 
in branch '3.8':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
https://github.com/python/cpython/commit/e866f33a48ee24e447fafd181f0da5f9584e0340


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[miss-islington]

miss-islington  added the comment:


New changeset 7917170c5b4793ca9443f753aaecb8fbb3ad54ef by Miss Skeleton (bot) 
in branch '3.9':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
https://github.com/python/cpython/commit/7917170c5b4793ca9443f753aaecb8fbb3ad54ef


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[miss-islington]

Change by miss-islington :


--
pull_requests: +21225
pull_request: https://github.com/python/cpython/pull/22141

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[miss-islington]

miss-islington  added the comment:


New changeset 22748a83d927d3da1beaed771be30887c42b2500 by Artem Bulgakov in 
branch 'master':
bpo-41316: Make tarfile follow specs for FNAME (GH-21511)
https://github.com/python/cpython/commit/22748a83d927d3da1beaed771be30887c42b2500


--
nosy: +miss-islington

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[miss-islington]

Change by miss-islington :


--
pull_requests: +21224
pull_request: https://github.com/python/cpython/pull/22140

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[Artem Bulgakov]

Artem Bulgakov  added the comment:

Hi. My PR doesn't remove the possibility to add tree into tar file. It only 
fixes header for GZIP compression. Any data after this header is not affected.

You can test it by creating two archives with the same data but one with my 
patch and the second without. All bytes after header are equal.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[Karthikeyan Singaravelan]

Change by Karthikeyan Singaravelan :


--
nosy: +ethan.furman

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[Emmanuel Arias]

Emmanuel Arias  added the comment:

Hi,

If I understand correctly, the name that you are using into the tar
is the basename of the file. I didn't test it yet, but this PR will
remove the possibility to create a file into the tar using the
source tree folder?

Maybe we can think about implement a parameter seems like arcname
on Zipfile?

What about that?

Cheers!

--
nosy: +eamanu

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[Artem Bulgakov]

Change by Artem Bulgakov :


--
keywords: +patch
pull_requests: +20646
stage:  -> patch review
pull_request: https://github.com/python/cpython/pull/21511

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue41316] tarfile: Do not write full path in FNAME field

[Artem Bulgakov]

New submission from Artem Bulgakov :

tarfile sets FNAME field to the path given by user: Lib/tarfile.py:424

It writes full path instead of just basename if user specified absolute path. 
Some archive viewer apps like 7-Zip may process file incorrectly. Also it 
creates security issue because anyone can know structure of directories on 
system and know username or other personal information.

You can reproduce this by running below lines in Python interpreter. Tested on 
Windows and Linux.

Python 3.8.2 (default, Apr 27 2020, 15:53:34)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> import tarfile
>>> open("somefile.txt", "w").write("sometext")
8
>>> tar = tarfile.open("/home/bulgakovas/file.tar.gz", "w|gz")
>>> tar.add("somefile.txt")
>>> tar.close()
>>> open("file.tar.gz", "rb").read()[:50]
b'\x1f\x8b\x08\x08cE\x10_\x02\xff/home/bulgakovas/file.tar\x00\xed\xd3M\n\xc20\x10\x86\xe1\xac=EO\x90'

You can see full path to file.tar (/home/bulgakovas/file.tar) as FNAME field. 
If you will write just tarfile.open("file.tar.gz", "w|gz"), FNAME will be equal 
to file.tar.

RFC1952 says about FNAME:
This is the original name of the file being compressed, with any directory 
components removed.

So tarfile must remove directory names from FNAME and write only basename of 
file.

--
components: Library (Lib)
messages: 373759
nosy: ArtemSBulgakov, lars.gustaebel
priority: normal
severity: normal
status: open
title: tarfile: Do not write full path in FNAME field
type: behavior
versions: Python 3.10, Python 3.5, Python 3.6, Python 3.7, Python 3.8, Python 
3.9

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com