Skip to content

gh-154987: Handle ValueError for drive-relative paths in tarfile filters - #154993

Open
zainnadeem786 wants to merge 1 commit into
python:mainfrom
zainnadeem786:bugfix/tarfile-drive-relative-filter-errors
Open

gh-154987: Handle ValueError for drive-relative paths in tarfile filters#154993
zainnadeem786 wants to merge 1 commit into
python:mainfrom
zainnadeem786:bugfix/tarfile-drive-relative-filter-errors

Conversation

@zainnadeem786

Copy link
Copy Markdown
Contributor

Summary

Fixes gh-154987.

On Windows, tarfile extraction filters use os.path.commonpath() to verify that extracted members remain inside the destination directory.

For drive-relative paths (for example Z:evil), ntpath.commonpath() raises ValueError because the paths are considered to be on different drives. That exception currently escapes instead of being translated into tarfile's existing structured extraction filter errors.

This PR catches that ValueError and treats those paths as outside the destination, preserving the existing extraction filter semantics.

Changes

  • Handle ValueError raised by os.path.commonpath() during destination containment checks.
  • Raise the existing:
    • OutsideDestinationError
    • LinkOutsideDestinationError
      instead of allowing a raw ValueError to escape.
  • Add regression tests covering:
    • drive-relative member paths
    • drive-relative symlink targets
    • drive-relative hardlink targets
    • errorlevel=0 continuation behaviour

Testing

Executed:

PCbuild\amd64\python.exe -m test test_tarfile -m "*drive_relative*" -v

PCbuild\amd64\python.exe -m test test_tarfile \
    -m "*drive_relative*" \
    -m test_absolute \
    -m test_absolute_symlink \
    -m test_absolute_hardlink \
    -m test_link_at_destination \
    -m test_normpath_realpath_mismatch \
    -m test_errorlevel -v

All targeted regression tests passed successfully.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

tarfile extraction filters raise raw ValueError for Windows drive-relative paths

1 participant