Skip to content

[3.10] gh-123270: Replaced SanitizedNames with a more surgical fix. (GH-123354) #123426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambv merged 6 commits into from
Sep 4, 2024
Merged

[3.10] gh-123270: Replaced SanitizedNames with a more surgical fix. (GH-123354) #123426

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c94488e
[3.10] [3.11] gh-123270: Replaced SanitizedNames with a more surgical…
jaraco Aug 27, 2024
87ac08d
Add some context to the assertion for troubleshooting.
jaraco Sep 2, 2024
d1eca1e
Remove tests not relevant to the backported security fix.
jaraco Sep 2, 2024
d5c243c
Restore the slash-prefixed paths in the malformed_paths test.
jaraco Sep 2, 2024
ee0d35f
Revert "Remove tests not relevant to the backported security fix."
jaraco Sep 4, 2024
45a7927
Skip failing tests, known to fail, referencing tracking bug.
jaraco Sep 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Remove tests not relevant to the backported security fix. 
Ref #123426 (comment)
  • Loading branch information
@jaraco
jaraco committed Sep 2, 2024
commit d1eca1e5799f08bc3e9c3adc6e50f0c8dbfc444d
33 changes: 0 additions & 33 deletions Lib/test/test_zipfile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3296,39 +3296,6 @@ def test_malformed_paths(self):
assert list(map(str, root.iterdir())) == ['../']
assert root.joinpath('..').joinpath('parent.txt').read_bytes() == b'content'

def test_unsupported_names(self):
"""
Path segments with special characters are readable.

On some platforms or file systems, characters like
``:`` and ``?`` are not allowed, but they are valid
in the zip file.
"""
data = io.BytesIO()
zf = zipfile.ZipFile(data, "w")
zf.writestr("path?", b"content")
zf.writestr("V: NMS.flac", b"fLaC...")
zf.filename = ''
root = zipfile.Path(zf)
contents = root.iterdir()
assert next(contents).name == 'path?'
item = next(contents)
assert item.name == 'V: NMS.flac', item.name
assert root.joinpath('V: NMS.flac').read_bytes() == b"fLaC..."

def test_backslash_not_separator(self):
"""
In a zip file, backslashes are not separators.
"""
data = io.BytesIO()
zf = zipfile.ZipFile(data, "w")
zf.writestr(DirtyZipInfo.for_name("foo\\bar", zf), b"content")
zf.filename = ''
root = zipfile.Path(zf)
(first,) = root.iterdir()
assert not first.is_dir()
assert first.name == 'foo\\bar', first.name


class DirtyZipInfo(zipfile.ZipInfo):
"""
Expand Down