From 8bfc40580056f5a467e953f933a23b26268e6ceb Mon Sep 17 00:00:00 2001 From: Shakir Mahmood Date: Thu, 24 Sep 2026 01:04:04 +0300 Subject: [PATCH] gh-156026: Document that the 'tar' filter does not bound link targets --- Doc/library/tarfile.rst | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index 0d8ce6e497915f..9a69dfbd49ca27 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1056,7 +1056,8 @@ can be: * the string ``'tar'``: Honor most *tar*-specific features (i.e. features of UNIX-like filesystems), but block features that are very likely to be - surprising or malicious. See :func:`tar_filter` for details. + surprising or malicious. This does not include limiting the targets of + symbolic links. See :func:`tar_filter` for details. * the string ``'data'``: Ignore or block most features specific to UNIX-like filesystems. Intended for extracting cross-platform data archives. @@ -1124,6 +1125,19 @@ reused in custom filters: Return the modified ``TarInfo`` member. + .. warning:: + + This filter does not limit where a link member *points*. + :attr:`TarInfo.linkname` is not checked, so a symbolic link whose target + is an absolute path, or a relative path that climbs outside the + destination, is extracted as given. + The rule above constrains where each member is *written*; it does not + constrain where a link resolves to. + + Only :func:`data_filter` refuses such members, raising + :class:`~tarfile.AbsoluteLinkError` or + :class:`~tarfile.LinkOutsideDestinationError`. + .. versionchanged:: next Filenames containing ``..`` components are now normalized.