shutil.unpack_archive(): security concerns not documented

[jwilk]

BPO	20749
Nosy	@jwilk, @ned-deily, @swenson
PRs	bpo-20749: Copy security warning to shutil #29184

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2014-02-23.21:13:37.938>
labels = ['easy', 'type-bug', '3.9', '3.10', '3.11', 'docs']
title = 'shutil.unpack_archive(): security concerns not documented'
updated_at = <Date 2021-10-23.02:13:01.873>
user = 'https://github.com/jwilk'

bugs.python.org fields:

activity = <Date 2021-10-23.02:13:01.873>
actor = 'swenson'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation']
creation = <Date 2014-02-23.21:13:37.938>
creator = 'jwilk'
dependencies = []
files = []
hgrepos = []
issue_num = 20749
keywords = ['patch', 'easy', 'newcomer friendly']
message_count = 3.0
messages = ['212029', '242454', '394170']
nosy_count = 4.0
nosy_names = ['jwilk', 'ned.deily', 'docs@python', 'swenson']
pr_nums = ['29184']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue20749'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']

[jwilk]

shutil.unpack_archive() uses tarfile.extractall() under the hood, so it's not suitable for unpacking untrusted archives. But this fact is not documented.

Please add a security warning to shutil.unpack_archive() documentation.

[BreamoreBoy]

If there is an agreed standard for security warnings I'll prepare a patch for this.

[ned-deily]

The warning from Tarfile.extractall (Doc/library/tarfile.rst -> https://docs.python.org/dev/library/tarfile.html#tarfile-objects) can be adapted for use here (Doc/library/shutil.rst -> https://docs.python.org/dev/library/shutil.html#archiving-operations).

[jwilk]

Fixed by GH-91844.