SIGN IN SIGN UP

gh-138158: Use the `"data"` tarfile extraction filter in `Tools/ssl/multissltests.py` (#138147)

The `Tools/ssl/multissltests.py` script may extract a possibly untrusted tarball.
Since the script does not necessarily use Python 3.14 or later (where the `"data"`
filter became the default `tarfile` extraction filter), the user may theoretically
suffer from a path traversal attack.

Although the script should not be used in production and usually relies on downloading
trusted sources, the `"data"` extraction filter is now explicitly used wherever relevant.
T
Tommaso Bona committed
31d3836f26096f9503ca68f4e89d927bc1e060cd
Parent: bacb777
Committed by GitHub <noreply@github.com> on 8/30/2025, 10:27:32 AM