Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ZIP extraction tests do not catch predictable temporary-file reuse

Open Beginner friendly
  • Is something wrong?
#7,638 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
testing

Research direction

The report identifies tests/test_utils.py and the TestExtractZippedPaths test class. Read the existing extraction cases, then apply the linked test-only change and run python -m pytest tests/test_utils.py::TestExtractZippedPaths. Done means all eight cases pass and the new tests catch predictable path reuse on the pre-fix revision.

Written by the indexing model from the issue text.

Description

The existing TestExtractZippedPaths cases pass against the implementation from before the fix for CVE-2026-25645. They do not exercise a pre-existing file at the basename destination or extraction of same-named members from different archives. Current Requests already contains the fix; this report concerns the missing regression coverage.

Expected Result

The extraction tests should catch reuse of a predictable temporary filename. Extracting a ZIP member should return its content without reusing or overwriting an unrelated existing file. Members with the same basename from different archives should retain separate paths and contents.

Actual Result

The six existing extraction cases pass on the pre-fix revision 8b9bc8fc0f63be84602387913c4b689f19efd028.

Two additional tests catch the regression. One creates an unrelated file at the old basename destination; the other extracts same-named members from two archives. Both fail on that pre-fix revision because extraction returns the reused path. All eight cases pass with the original fix, 66d21cb07bd6255b1280291c4fafb71803cdb3b7, and on main at 3c7baaa05ab4aa49cc819ce3a819d260de19c157.

Reproduction Steps

The complete test-only change is in openforge-live/requests@abf2080. It changes only tests/test_utils.py, uses small ZIP files in pytest temporary directories, and leaves production code unchanged.

Apply that commit to main at 3c7baaa, then run:

python -m pytest tests/test_utils.py::TestExtractZippedPaths

The expected result is eight passes. Running the same extraction test class against the pre-fix package produces two failures at the assertions that the returned paths must be distinct. The six existing cases still pass.

The prepared commit is linked here because this account cannot open a pull request under the repository's current collaborators-only PR setting.

System Information

Verified on Linux with Python 3.13.13 and pytest 9.0.3, importing Requests from the source revisions above. The entire current tests/test_utils.py file passes: 218 passed, 13 skipped. The full integration suite, Windows and PyPy were not run.

Dominant language
Python
Stars
54.6k
Forks
12.1k
Avg merge
18m
Merged PRs (30d)
1

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from psf/requests

All issues in psf/requests

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.