Extract tarballs more safely on Python with tarfile filters (PEP 706) (…

…GH-201)

Co-authored-by: Vinay Sajip <vinay_sajip@yahoo.co.uk>

distlib/util.py

@@ -1249,6 +1249,19 @@ def check_path(path):
             for tarinfo in archive.getmembers():
                 if not isinstance(tarinfo.name, text_type):
                     tarinfo.name = tarinfo.name.decode('utf-8')
+
+        # Limit extraction of dangerous items, if this Python
+        # allows it easily. If not, just trust the input.
+        # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
+        def extraction_filter(member, path):
+            """Run tarfile.tar_filter, but raise the expected ValueError"""
+            # This is only called if the current Python has tarfile filters
+            try:
+                return tarfile.tar_filter(member, path)
+            except tarfile.FilterError as exc:
+                raise ValueError(str(exc))
+        archive.extraction_filter = extraction_filter
+
         archive.extractall(dest_dir)
 
     finally:

tests/test_util.py

@@ -471,6 +471,10 @@ def test_unarchive(self):
         )
         bad_archives = ('bad.zip', 'bad.tar', 'bad.tar.gz', 'bad.tar.bz2')
 
+        # Test "evil" tarball on 3.12 *or* on Python with PEP-706 backported
+        if sys.version_info > (3, 12) or hasattr(tarfile, 'data_filter'):
+            bad_archives += ('evil.tar.gz',)
+
         for name, cls, mode, lister in good_archives:
             td = tempfile.mkdtemp()
             archive = None