Skip to content

gh-151558: Fix symlink escape via tarfile hardlink-extraction fallback#151559

Merged
encukou merged 4 commits into
python:mainfrom
StanFromIreland:tarfile_sneaky_hardlink_fallback_deep
Jun 23, 2026
Merged

gh-151558: Fix symlink escape via tarfile hardlink-extraction fallback#151559
encukou merged 4 commits into
python:mainfrom
StanFromIreland:tarfile_sneaky_hardlink_fallback_deep

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Jun 16, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland requested review from ambv and encukou June 16, 2026 20:06
@bedevere-app bedevere-app Bot mentioned this pull request Jun 16, 2026
Open
@encukou encukou added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 17, 2026
@bedevere-bot

bedevere-bot commented Jun 17, 2026

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit 4a477d6 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151559%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jun 17, 2026
@encukou encukou added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Jun 17, 2026
@encukou

encukou commented Jun 17, 2026

Copy link
Copy Markdown
Member

Looks good, but let's see how the different filesystems on Buildbot react.

@StanFromIreland

StanFromIreland commented Jun 17, 2026

Copy link
Copy Markdown
Member Author

Oh no, more Windows trouble (which is quite annoying seeing as I can't locally test: https://buildbot.python.org/#/builders/1213/builds/993/steps/4/logs/stdio

@StanFromIreland

StanFromIreland commented Jun 17, 2026

Copy link
Copy Markdown
Member Author

!buildbot Windows

@bedevere-bot

bedevere-bot commented Jun 17, 2026

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @StanFromIreland for commit f6bc76e 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F151559%2Fmerge

The command will test the builders whose names match following regular expression: Windows

The builders matched are:

  • AMD64 Windows11 Non-Debug PR
  • AMD64 Windows PGO NoGIL PR
  • AMD64 Windows PGO PR
  • ARM64 Windows Non-Debug PR
  • AMD64 Windows10 PR
  • ARM64 Windows PR
  • AMD64 Windows Server 2022 NoGIL PR
  • AMD64 Windows PGO NoGIL Tailcall PR
  • AMD64 Windows PGO Tailcall PR
  • AMD64 Windows11 Refleaks PR

@StanFromIreland

StanFromIreland commented Jun 23, 2026

Copy link
Copy Markdown
Member Author

All Buildbots that failed previously now pass.

@encukou encukou merged commit 27dd970 into python:main Jun 23, 2026
64 checks passed
@miss-islington-app

miss-islington-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@encukou

encukou commented Jun 23, 2026

Copy link
Copy Markdown
Member

Thank you!

@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151997 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151998 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151999 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-152000 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 23, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 27dd970bf6b17ebca7c8ed486a40ab043ed7af8f 3.10

@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-152001 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jun 23, 2026
@StanFromIreland StanFromIreland deleted the tarfile_sneaky_hardlink_fallback_deep branch June 23, 2026 13:37
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @StanFromIreland
[3.13] gh-151558: Fix symlink escape via tarfile hardlink-extractio…
771d12d 
…n fallback (GH-151559)

(cherry picked from commit 27dd970)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @StanFromIreland
[3.14] gh-151558: Fix symlink escape via tarfile hardlink-extractio…
79c06bd 
…n fallback (GH-151559)

(cherry picked from commit 27dd970)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @StanFromIreland
[3.15] gh-151558: Fix symlink escape via tarfile hardlink-extractio…
672825e 
…n fallback (GH-151559) (#151997)

(cherry picked from commit 27dd970)

Co-authored-by: Stan Ulbrych <stan@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ambv ambv Awaiting requested review from ambv

@encukou encukou Awaiting requested review from encukou

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Assignees

@StanFromIreland StanFromIreland

Labels

needs backport to 3.10 only security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@StanFromIreland @bedevere-bot @encukou