Skip to content

gh-146581: Update docs for dangerous filenames in ZIP files#149994

Merged
serhiy-storchaka merged 2 commits into
python:mainfrom
serhiy-storchaka:unzip-docs-bad-filenames
May 19, 2026
Merged

gh-146581: Update docs for dangerous filenames in ZIP files#149994
serhiy-storchaka merged 2 commits into
python:mainfrom
serhiy-storchaka:unzip-docs-bad-filenames

Conversation

@serhiy-storchaka
Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka commented May 18, 2026 •
edited by bedevere-app Bot
Loading

@serhiy-storchaka serhiy-storchaka added docs Documentation in the Doc dir skip news needs backport to 3.13 bugs and security fixes labels May 18, 2026
@serhiy-storchaka serhiy-storchaka added needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels May 18, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Docs PRs May 18, 2026
@bedevere-app bedevere-app Bot mentioned this pull request May 18, 2026
Open
@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community Bot commented May 18, 2026 •
edited
Loading

Documentation build overview

📚 cpython-previews | 🛠️ Build #32743883 | 📁 Comparing cadce7a against main (bd6bf91)

  🔍 Preview build  

8 files changed · + 1 added · ± 7 modified

+ Added

± Modified

StanFromIreland
StanFromIreland reviewed May 18, 2026
View reviewed changes
Comment thread Doc/library/shutil.rst Outdated
Comment thread Doc/library/zipfile.rst Outdated
Comment thread Doc/library/zipfile.rst Outdated
@serhiy-storchaka @StanFromIreland
Apply suggestions from code review
cadce7a 
Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland
StanFromIreland approved these changes May 18, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks Serhiy

@serhiy-storchaka serhiy-storchaka mentioned this pull request May 18, 2026
Closed
@serhiy-storchaka
Copy link
Copy Markdown
Member Author

serhiy-storchaka commented May 18, 2026

This PR was inspired by @sepastian's PR #111824. I missed that the docs also need an update in the previous PR. filenames with two dots ".." is unclear -- it can be read as with the ".." component (like it should be) or as literally containing the ".." substring (like it was implemented in _unpack_zipfile). Also, filenames starting with "/" was not only absolute paths.

@StanFromIreland
Copy link
Copy Markdown
Member

StanFromIreland commented May 18, 2026

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <sebastian.gassner@gmail.com>.

@merwok
Copy link
Copy Markdown
Member

merwok commented May 19, 2026

Yes, and/or Misc/ACKS

@serhiy-storchaka serhiy-storchaka merged commit ba0aca3 into python:main May 19, 2026
34 checks passed
@github-project-automation github-project-automation Bot moved this from Todo to Done in Docs PRs May 19, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented May 19, 2026

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@serhiy-storchaka serhiy-storchaka deleted the unzip-docs-bad-filenames branch May 19, 2026 08:36
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 19, 2026

GH-150064 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 19, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 19, 2026

GH-150065 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 19, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 19, 2026

GH-150066 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label May 19, 2026
@serhiy-storchaka
Copy link
Copy Markdown
Member Author

serhiy-storchaka commented May 19, 2026

This PR was inspired by @sepastian's PR #111824.

In that case, I would suggest adding him to the Co-Authored-By: Sebastian Gassner <sebastian.gassner@gmail.com>.

Good idea. Although I only took idea that some changes were needed here. The changes themselves were different, and applied more wide.

serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka
[3.14] gh-146581: Update docs for dangerous filenames in ZIP files (G…
8e13025 
…H-149994) (GH-150065)

(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka
[3.13] gh-146581: Update docs for dangerous filenames in ZIP files (G…
8ee6aff 
…H-149994) (GH-150066)

(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
serhiy-storchaka added a commit that referenced this pull request May 19, 2026
@miss-islington @serhiy-storchaka
[3.15] gh-146581: Update docs for dangerous filenames in ZIP files (G…
65b2554 
…H-149994) (GH-150064)

gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994)
(cherry picked from commit ba0aca3)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Sebastian Gassner <sebastian.gassner@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes

@giampaolo giampaolo Awaiting requested review from giampaolo giampaolo is a code owner

Assignees

No one assigned

Labels

docs Documentation in the Doc dir skip news

Projects

Docs PRs
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@serhiy-storchaka @StanFromIreland @merwok