Fixes Issue #6972: The zipfile module no longer overwrites files outside of
its destination path when extracting malicious zip files.
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst
index e975baa..df24bb7 100644
--- a/Doc/library/zipfile.rst
+++ b/Doc/library/zipfile.rst
@@ -242,6 +242,16 @@
.. versionadded:: 2.6
+ .. note::
+
+ If a member filename is an absolute path, a drive/UNC sharepoint and
+ leading (back)slashes will be stripped, e.g.: ``///foo/bar`` becomes
+ ``foo/bar`` on Unix, and ``ะก:\foo\bar`` becomes ``foo\bar`` on Windows.
+ And all ``".."`` components in a member filename will be removed, e.g.:
+ ``../../foo../../ba..r`` becomes ``foo../ba..r``. On Windows illegal
+ characters (``:``, ``<``, ``>``, ``|``, ``"``, ``?``, and ``*``)
+ replaced by underscore (``_``).
+
.. method:: ZipFile.read(name[, pwd])