[3.10] gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (GH-135037) (#135070)
Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517. (cherry picked from commit 3612d8f51741b11f36f8fb0494d79086bac9390a) (cherry picked from commit c358142cab7ce621a2745262a90df967b357f61c) (cherry picked from commit 371b4eaadcd5846d79af8f7912e4320f9cd9fae4) Co-authored-by: Łukasz Langa <lukasz@langa.pl> Signed-off-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
T
T. Wouters committed
9c1110ef6652687d7c55f590f909720eddde965a
Parent: c71ea4b
Committed by GitHub <noreply@github.com>
on 6/3/2025, 5:02:29 PM