Matej Cepl
2db1a650e2
ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=425
70 lines
2.3 KiB
Diff
70 lines
2.3 KiB
Diff
From b73fe12d4d85fc92e4b9658e417046b68fb68ecc Mon Sep 17 00:00:00 2001
|
|
From: nick sung <sungboss2004@gmail.com>
|
|
Date: Fri, 17 May 2019 15:45:31 +0800
|
|
Subject: [PATCH 1/4] bpo-36260: Add pitfalls to zipfile module documentation
|
|
|
|
We saw vulnerability warning description (including zip bomb) in Doc/library/xml.rst file.
|
|
This gave us the idea of documentation improvement.
|
|
|
|
So, we moved a little bit forward :P
|
|
And the doc patch can be found (pr).
|
|
---
|
|
Doc/library/zipfile.rst | 29 +++++++++++++++++++++++++++++
|
|
1 file changed, 29 insertions(+)
|
|
|
|
--- a/Doc/library/zipfile.rst
|
|
+++ b/Doc/library/zipfile.rst
|
|
@@ -553,5 +553,47 @@ Command-line options
|
|
|
|
Test whether the zipfile is valid or not.
|
|
|
|
+Decompression pitfalls
|
|
+----------------------
|
|
|
|
+The extraction in zipfile module might fail due to some pitfalls
|
|
+listed below.
|
|
+
|
|
+From file itself
|
|
+~~~~~~~~~~~~~~~~
|
|
+
|
|
+Decompression may fail due to incorrect password / CRC checksum
|
|
+/ ZIP format or unsupported compression method / decryption.
|
|
+
|
|
+File System limitations
|
|
+~~~~~~~~~~~~~~~~~~~~~~~
|
|
+
|
|
+Exceeding limitations on different file systems can cause
|
|
+decompression failed. Such as allowable characters in the
|
|
+directory entries, length of the file name, length of the
|
|
+pathname, size of a single file, and number of files, etc.
|
|
+
|
|
+Resources limitations
|
|
+~~~~~~~~~~~~~~~~~~~~~
|
|
+
|
|
+The lack of memory or disk volume would lead to decompression
|
|
+failed. For example, decompression bombs (aka `ZIP bomb`_) apply
|
|
+to zipfile library that can cause disk volume exhaustion.
|
|
+
|
|
+Interruption
|
|
+~~~~~~~~~~~~
|
|
+
|
|
+Interruption during the decompression, such as pressing control-C
|
|
+or killing the decompression process may result in incomplete
|
|
+decompression of the archive.
|
|
+
|
|
+Default behaviors of extraction
|
|
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
+
|
|
+Not knowing the default extraction behaviors can cause unexpected
|
|
+decompression results. For example, when extracting the same
|
|
+archive twice, it overwrites files without asking.
|
|
+
|
|
+
|
|
+.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
|
|
.. _PKZIP Application Note: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst
|
|
@@ -0,0 +1 @@
|
|
+Add decompression pitfalls to zipfile module documentation.
|
|
\ No newline at end of file
|