gh-57911: Sanitize symlink targets in tarfile on win32

[wiomoc]

CC @encukou

• Issue: relative symlinks in tarfile.extract broken (windows) #57911

[encukou]

Should this be done for hardlinks as well?

I'd prefer saying “rewrite” rather than “sanitize”, as this is not fixing unsafe input.

We should probably skip this for leading // -- that would turn symlink targets into UNC paths, where I'm not sure of the security implications, and anyway it's not something you'd find in a portable UNIX-based tarball.

[wiomoc]

Should this be done for hardlinks as well?

This problem doesn't seam to occur when creating hardlinks:

>>>os.mkdir("tmp") >>>os.mkdir("tmp\\child") >>>open("tmp\\child\\test.txt", "w").write("hello world") 11>>>os.link("tmp/child/test.txt", "tmp/testlink.txt") >>>open("tmp\\testlink.txt").read() 'hello world'

We should probably skip this for leading // -- that would turn symlink targets into UNC paths, where I'm not sure of the security implications, and anyway it's not something you'd find in a portable UNIX-based tarball.

On the one hand, I see the risk of security implications, but I also note that in pathlib, slashes are also replaced in UNC paths.

[encukou]

OK; re-reading the duscussion I see experts suggesting to always replace, so let's go with that.

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @encukou for commit 942b6e3 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F138309%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[encukou]

Suggested change

	When extracting tar files on Windows Posix flavoured path separators in symlink
	targets will be replaced by backward-slashes to prevent corrupted links.
	When extracting tar files on Windows, slashes in symlink
	targets will be replaced by backslashes to prevent corrupted links.

[encukou]

Looks good! Could you also add an entry to Doc/whatsnew/3.15.rst?

[encukou]

Thank you!

[picnixz]

I think this broke some buildbots: https://buildbot.python.org/#/builders/914. It wasn't detected until #138276 (which was 20h ago, but this change is 2 days ago and the previous buildbot run was 3 days ago)

[AA-Turner]

@picnixz if you open a revert PR as draft, you could use !buildbot to check this worker & see if it passes again?

A

[picnixz]

I'm not on a dev session but I'll do it tomorrow if no one beats me to it.

[wiomoc]

The test only fails, when running on a Windows system with disabled symlink support - therefore it didn't occure on GH actions.
I have a possible fix in #138626