Bug report
The tar extraction filter allows archive members to create hard links or symbolic links that point outside the extraction directory.
I understand from the security response that this is intentional, mainly to allow things such as /dev/null and other system paths. However, I think the current documentation does not make the security implications of this behavior clear enough.
The documentation for tar_filter currently describes it as refusing to extract files whose absolute path, after following symlinks, would end up outside the destination. This can be easy to interpret as meaning that links themselves are restricted to the extraction directory.
For example, an archive can contain a hard link with an absolute target such as:
When extracted with:
tar.extractall(destination, filter="tar")
the hard link can point to the existing file outside destination.
This is different from the behavior of the data filter, which rejects links that point outside the destination.
I think the tar_filter documentation should explicitly state that:
- Links are allowed to point outside the extraction directory.
- This includes both absolute and relative link targets where applicable.
- Extracting an untrusted archive with
filter="tar" may therefore create links to files outside the extraction directory.
- Applications that need to safely extract untrusted archives should use the
data filter instead.
Something along those lines would make the distinction between tar and data much harder to misunderstand.
Why this matters
An application developer may reasonably assume that using filter="tar" provides a strong boundary around the extraction directory, especially because the documentation discusses preventing files from ending up outside the destination.
Explicitly documenting that external links are intentionally permitted would make the behavior much clearer and help prevent applications from using the wrong filter for untrusted archives.
I can provide a minimal reproducer showing the behavior if useful.
CPython versions tested on:
3.12, 3.13, 3.14, CPython main branch
Operating systems tested on:
Linux
Bug report
The
tarextraction filter allows archive members to create hard links or symbolic links that point outside the extraction directory.I understand from the security response that this is intentional, mainly to allow things such as
/dev/nulland other system paths. However, I think the current documentation does not make the security implications of this behavior clear enough.The documentation for
tar_filtercurrently describes it as refusing to extract files whose absolute path, after following symlinks, would end up outside the destination. This can be easy to interpret as meaning that links themselves are restricted to the extraction directory.For example, an archive can contain a hard link with an absolute target such as:
When extracted with:
the hard link can point to the existing file outside
destination.This is different from the behavior of the
datafilter, which rejects links that point outside the destination.I think the
tar_filterdocumentation should explicitly state that:filter="tar"may therefore create links to files outside the extraction directory.datafilter instead.Something along those lines would make the distinction between
taranddatamuch harder to misunderstand.Why this matters
An application developer may reasonably assume that using
filter="tar"provides a strong boundary around the extraction directory, especially because the documentation discusses preventing files from ending up outside the destination.Explicitly documenting that external links are intentionally permitted would make the behavior much clearer and help prevent applications from using the wrong filter for untrusted archives.
I can provide a minimal reproducer showing the behavior if useful.
CPython versions tested on:
3.12, 3.13, 3.14, CPython main branch
Operating systems tested on:
Linux