[PR] tar.py: Always check member paths [buildstream]

["juergbi (via GitHub)" <gi...@apache.org>]

juergbi opened a new pull request, #1932:
URL: https://github.com/apache/buildstream/pull/1932

   The paths of tarball members are already checked to guard against extraction outside the target directory in the common case. However, if `base-dir` is set to the empty string, the checks were skipped.
   
   This corrects the code to always check member paths. On Python 3.12+, this uses the new extraction filter support, which should also ensure consistent behavior on Python 3.14+, which will use the restrictive 'data' filter by default.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@buildstream.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] tar.py: Always check member paths [buildstream]

["juergbi (via GitHub)" <gi...@apache.org>]

juergbi merged PR #1932:
URL: https://github.com/apache/buildstream/pull/1932


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@buildstream.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org