shutil.unpack_archive skips false negatives containing '..'

[sepastian]

I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive.

This is right, one file inside the archive is named somefile..ipynb, with two dots, likely misspelled.

This leads to a problem, because unpack_archive will skip extracting this file here, because it assumes that the file contains relative path components. The file is missing quietly in the extracted archive.

While skipping the file is different from standard behavior, the assumption that a file with a path containing two dots would be a relative path is also wrong. A relative path component is identified by "../" instead.

I can am going to submit a PR.

Linked PRs

• gh-111791: delegating extraction to zipfile module's extractall() method  #111824

[d-walkama]

Hi @sepastian, I actually just ran into this bug today. Do you know if it only affects zip files? As a workaround, could I create a .gztar?

[sepastian]

Hi @d-walkama, I don't know, if using a tar file would fix the issue. Just give it a try.

I have submitted a PR today, which fixes the issue. You could also wait for that to get merged.

Or you could just use zipfile.extractll() instead and for the time being, which works as expected.

[sepastian]

This is a bug in the standard library and it has been sitting here for a year now. What are the next steps, anything I can do to move this forward? Maybe @AlexWaygood knows what to do next?

This is my first contribution to CPython, so I have no idea if there's anything I can do to make progress here. If there's anything, please let me know, I'm happy to contribute (more)...

[someguynamedjosh]

I humorously managed to run into this bug with a file that was not misspelled. This soundtrack contains a track titled "66-6 St.", and when the soundtrack is downloaded in its entirety, you then get a .zip archive where one of the files is called "07 - 66-6 St..flac". (For this use case though, it's easy enough to just use zipfile instead.)

[sepastian]

Thanks @someguynamedjosh !

Any chance this can get merged into Python @AlexWaygood? This is a bug and the PR has been sitting around for years. Anything I can do to make it happen?

[AlexWaygood]

I'm afraid I don't really know anything about the internals of the shutil module and haven't got much spare time for CPython development these days!

You might find this page of the devguide helpful: https://devguide.python.org/getting-started/pull-request-lifecycle/#pull-request-lifecycle. You can also consider posting something on Discourse similar to this: https://discuss.python.org/t/request-for-merge-fix-http-cookies-module-to-support-obsolete-rfc-850-date-format/73944

[picnixz]

I can see how .. inside the name is actually wrongly interpreted. However, considering this may changes an existing (wrong) behavior, I think it's better if we:

• fix handling of .. in shutil.unpack_archive: we would still skip files that are absolute or relative (so with .startswith(('/', '../')), but we would not delegate to zipfile.
• in a separate issue and only for the main branch, we could to zipfile. But before that, we will need a separate discussion, likely a DPO one.

[serhiy-storchaka]

This was fixed in #146591.