diff options
| author | Gregory P. Smith <greg@krypto.org> | 2013-02-07 22:15:51 -0800 |
|---|---|---|
| committer | Gregory P. Smith <greg@krypto.org> | 2013-02-07 22:15:51 -0800 |
| commit | 66f7fb5781b5689c198b11d014e7bf82a04bdff1 (patch) | |
| tree | d876ace693ab48f8ce9df96cd2ebc95e13ec94d8 | |
| parent | 564ce09d481fe83bae47f84f4662b883a59728fb (diff) | |
| parent | 2372413e246f744e8fa6efbc754d377469c713bc (diff) | |
| download | cpython-66f7fb5781b5689c198b11d014e7bf82a04bdff1.tar.gz | |
Issue #6972: keep the warning about untrusted extraction and mention
the version it was improved in.
| -rw-r--r-- | Doc/library/zipfile.rst | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst index b00e26d9c0..c63b23bffb 100644 --- a/Doc/library/zipfile.rst +++ b/Doc/library/zipfile.rst @@ -260,9 +260,15 @@ ZipFile Objects be a subset of the list returned by :meth:`namelist`. *pwd* is the password used for encrypted files. - .. note:: + .. warning:: + + Never extract archives from untrusted sources without prior inspection. + It is possible that files are created outside of *path*, e.g. members + that have absolute filenames starting with ``"/"`` or filenames with two + dots ``".."``. - See :meth:`extract` note. + .. versionchanged:: 3.3.1 + The zipfile module attempts to prevent that. See :meth:`extract` note. .. method:: ZipFile.printdir() |