Patch #1262036: Prevent TarFiles from being added to themselves under
certain conditions.
Will backport to 2.5.
diff --git a/Lib/tarfile.py b/Lib/tarfile.py
index 46031e1..658f214 100644
--- a/Lib/tarfile.py
+++ b/Lib/tarfile.py
@@ -1052,7 +1052,7 @@
can be determined, `mode' is overridden by `fileobj's mode.
`fileobj' is not closed, when TarFile is closed.
"""
- self.name = name
+ self.name = os.path.abspath(name)
if len(mode) > 1 or mode not in "raw":
raise ValueError("mode must be 'r', 'a' or 'w'")
@@ -1064,7 +1064,7 @@
self._extfileobj = False
else:
if self.name is None and hasattr(fileobj, "name"):
- self.name = fileobj.name
+ self.name = os.path.abspath(fileobj.name)
if hasattr(fileobj, "mode"):
self.mode = fileobj.mode
self._extfileobj = True
@@ -1200,24 +1200,12 @@
except (ImportError, AttributeError):
raise CompressionError("gzip module is not available")
- pre, ext = os.path.splitext(name)
- pre = os.path.basename(pre)
- if ext == ".tgz":
- ext = ".tar"
- if ext == ".gz":
- ext = ""
- tarname = pre + ext
-
if fileobj is None:
fileobj = file(name, mode + "b")
- if mode != "r":
- name = tarname
-
try:
- t = cls.taropen(tarname, mode,
- gzip.GzipFile(name, mode, compresslevel, fileobj)
- )
+ t = cls.taropen(name, mode,
+ gzip.GzipFile(name, mode, compresslevel, fileobj))
except IOError:
raise ReadError("not a gzip file")
t._extfileobj = False
@@ -1236,21 +1224,13 @@
except ImportError:
raise CompressionError("bz2 module is not available")
- pre, ext = os.path.splitext(name)
- pre = os.path.basename(pre)
- if ext == ".tbz2":
- ext = ".tar"
- if ext == ".bz2":
- ext = ""
- tarname = pre + ext
-
if fileobj is not None:
fileobj = _BZ2Proxy(fileobj, mode)
else:
fileobj = bz2.BZ2File(name, mode, compresslevel=compresslevel)
try:
- t = cls.taropen(tarname, mode, fileobj)
+ t = cls.taropen(name, mode, fileobj)
except IOError:
raise ReadError("not a bzip2 file")
t._extfileobj = False
@@ -1455,8 +1435,7 @@
arcname = name
# Skip if somebody tries to archive the archive...
- if self.name is not None \
- and os.path.abspath(name) == os.path.abspath(self.name):
+ if self.name is not None and os.path.abspath(name) == self.name:
self._dbg(2, "tarfile: Skipped %r" % name)
return