[issue45170] tarfile missing cross-directory checking

[Eric V. Smith]

Eric V. Smith <eric at trueblade.com> added the comment:

This is documented in the tarfile docs:

Warning

Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with "/" or filenames with two dots "..".

----------
nosy: +eric.smith

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue45170>
_______________________________________