From f5c5877f4fed6bd7e908942665522d812cfacfee Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Thu, 8 Oct 2026 14:00:53 +0200
Subject: [PATCH] gh-156026: Add warning about link targets to
 tarfile.tar_filter

---
 Doc/library/tarfile.rst | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst
index 0d8ce6e497915fd..487c3660c431335 100644
--- a/Doc/library/tarfile.rst
+++ b/Doc/library/tarfile.rst
@@ -1124,6 +1124,13 @@ reused in custom filters:
 
   Return the modified ``TarInfo`` member.
 
+  .. warning::
+
+     This filter does not check link targets (:attr:`TarInfo.linkname`).
+     It allows benign cases (like links to ``/dev/null``), but it also allows
+     links (symbolic and hard) to arbitrary files on the filesystem,
+     potentially granting unintended access to these files.
+
   .. versionchanged:: next
 
      Filenames containing ``..`` components are now normalized.