Skip to content

[3.15] gh-156002: Keep reading through monkey-patched zipfile decompressors (GH-157180) - #157268

Merged
hugovk merged 1 commit into
python:3.15from
encukou:backport-e2311cf-3.15
Sep 15, 2026
Merged

hugovk merged 1 commit into
python:3.15from
encukou:backport-e2311cf-3.15

Conversation

@encukou

@encukou encukou commented Sep 10, 2026

Copy link
Copy Markdown
Member

GH-156003 made ZipExtFile._read1() call decompress(data, max_length) on non-deflate decompressors and consult needs_input before reading more. A decompressor installed by monkey-patching _get_decompressor() (as projects like zipfile-zstd, zipfile-deflate64, ... do) may support neither, and every read through it then failed with AttributeError.

  • Make LZMADecompressor.needs_input public to simplify implementation.
  • Make the needs_input attribute optional.
  • If decompress() fails with TypeError, try again with one argument.
  • Add tests for future changes, so we can make informed decisions about breaking monkey-patchers. (cherry picked from commit e2311cf)

The backport omits emitting a DeprecationWarning.

…ecompressors (pythonGH-157180)

pythonGH-156003 made ZipExtFile._read1() call decompress(data, max_length) on
non-deflate decompressors and consult needs_input before reading more. A
decompressor installed by monkey-patching _get_decompressor() (as projects
like zipfile-zstd, zipfile-deflate64, ... do) may support neither, and every read
through it then failed with AttributeError.

- Make LZMADecompressor.needs_input public to simplify implementation.
- Make the needs_input attribute optional.
- If `decompress()` fails with TypeError, try again with one argument.
- Since the fallback to one-argument call is a maintenance burden, raise
  DeprecationWarning.
- Add tests for future changes, so we can make informed decisions
  about breaking monkey-patchers.
(cherry picked from commit e2311cf)

Co-authored-by: rasmusfaber <rfaber@gmail.com>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
@encukou

encukou commented Sep 15, 2026

Copy link
Copy Markdown
Member Author

@hugovk, this fixes real-world uses of private API, who were broken by a security fix #156003. (We document that this API might break, but users of the naughty libraries will likely blame Python as unstable anyway).

Your call on whether you want it in 3.15.0, but I'd recommend it.

@encukou encukou added the needs backport to 3.14 bugs and security fixes label Sep 15, 2026
@hugovk

hugovk commented Sep 15, 2026

Copy link
Copy Markdown
Member

In it goes, thanks!

@hugovk
hugovk merged commit f507e69 into python:3.15 Sep 15, 2026
61 checks passed
@miss-islington-app

Copy link
Copy Markdown

Thanks @encukou for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Sep 15, 2026

Copy link
Copy Markdown

GH-157557 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants