Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5546b00

Browse files
committed
Issue #6972: keep the warning about untrusted extraction and mention
the version it was improved in.
2 parents cf6e21c + f1319d8 commit 5546b00

1 file changed

Lines changed: 8 additions & 2 deletions

File tree

Doc/library/zipfile.rst

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -260,9 +260,15 @@ ZipFile Objects
260260
be a subset of the list returned by :meth:`namelist`. *pwd* is the password
261261
used for encrypted files.
262262

263-
.. note::
263+
.. warning::
264+
265+
Never extract archives from untrusted sources without prior inspection.
266+
It is possible that files are created outside of *path*, e.g. members
267+
that have absolute filenames starting with ``"/"`` or filenames with two
268+
dots ``".."``.
264269

265-
See :meth:`extract` note.
270+
.. versionchanged:: 3.3.1
271+
The zipfile module attempts to prevent that. See :meth:`extract` note.
266272

267273

268274
.. method:: ZipFile.printdir()

0 commit comments

Comments
 (0)