docs: Zipfile contains a 13-years outdated warning regarding path sanitization
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- documentation
Research direction
Start with the ZipFile.extractall documentation linked in the issue and review the related _extract_member implementation in Lib/zipfile/init.py. Remove the outdated path-sanitization warning, then build or validate the documentation to confirm the extract() and extractall() references remain correct.
Written by the indexing model from the issue text.
Description
Documentation
The extract/extractall documentation contains a warning that became outdated 13 years ago:
https://docs.python.org/3/library/zipfile.html#zipfile.ZipFile.extractall
"Warning: Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, for example, members that have absolute filenames or filenames with “..” components. This module attempts to prevent that. See extract() note."
This incorrect and completely outdated comment should have been deleted when the malicious zip sanitization was added to Python 13 years ago, in February 2013:
https://github.com/python/cpython/commit/b47acbf46abd425f69dcc03e9b4f0c7f7c321ac2
Here's the official Python code:
https://github.com/python/cpython/blob/main/Lib/zipfile/__init__.py#L2467
Both extract() and extractall() use _extract_member, which performs complete sanitizing:
# 1. Strips leading slashes (/), drive letters (C:), and UNC paths (\\server\share)
drive, root, arcname = os.path.splitroot(arcname)
...
# 2. Defines invalid parts: empty strings, current directory (.), and parent directory (..)
invalid_path_parts = ('', os.path.curdir, os.path.pardir)
# 3. Filters out any occurrences of '.' and '..'
arcname = os.path.sep.join(x for x in arcname.split(os.path.sep)
if x not in invalid_path_parts)
And even the original Zip Slip author said that Python is not vulnerable:
https://security.snyk.io/research/zip-slip-vulnerability
"We also vetted the Ruby and Python ecosystems and couldn’t find any vulnerable code snippets or libraries. In fact, Python libraries were vulnerable until fixed in 2014. Ruby has a number of existing vulnerabilities that have been fixed in previous versions here , here and here."
(He's wrong about 2014; Python added the malicious Zip path sanitization in February 2013.)
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 36k
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 560
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from python/cpython
-
stdlib type-feature
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
stdlib type-feature
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
build type-bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
stdlib topic-email type-feature
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
3.13 3.14 3.15 interpreter-core OS-windows
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100