Repository navigation
shutil.unpack_archive skips false negatives containing '..' #111791
Description
I tried to extract a ZIP archive which contains a file named somefile..ipynb using shutil.unpack_archive.
This is right, one file inside the archive is named somefile..ipynb, with two dots, likely misspelled.
This leads to a problem, because unpack_archive will skip extracting this file here, because it assumes that the file contains relative path components. The file is missing quietly in the extracted archive.
While skipping the file is different from standard behavior, the assumption that a file with a path containing two dots would be a relative path is also wrong. A relative path component is identified by "../" instead.
I can am going to submit a PR.
Activity
[-]Don't skip files containing '..'[/-][+]shutil.unpack_archive skips false positives containing '..'[/+][-]shutil.unpack_archive skips false positives containing '..'[/-][+]shutil.unpack_archive skips false negatives containing '..'[/+]fixing python#111791: delegating extraction in shutil.unpack_archive …
d-walkama commentedon Nov 7, 2023
Hi @sepastian, I actually just ran into this bug today. Do you know if it only affects zip files? As a workaround, could I create a .gztar?
sepastian commentedon Nov 7, 2023
Hi @d-walkama, I don't know, if using a tar file would fix the issue. Just give it a try.
I have submitted a PR today, which fixes the issue. You could also wait for that to get merged.
Or you could just use zipfile.extractll() instead and for the time being, which works as expected.
sepastian commentedon Dec 9, 2024
This is a bug in the standard library and it has been sitting here for a year now. What are the next steps, anything I can do to move this forward? Maybe @AlexWaygood knows what to do next?
This is my first contribution to CPython, so I have no idea if there's anything I can do to make progress here. If there's anything, please let me know, I'm happy to contribute (more)...
someguynamedjosh commentedon Aug 8, 2025
I humorously managed to run into this bug with a file that was not misspelled. This soundtrack contains a track titled "66-6 St.", and when the soundtrack is downloaded in its entirety, you then get a .zip archive where one of the files is called "07 - 66-6 St..flac". (For this use case though, it's easy enough to just use zipfile instead.)
sepastian commentedon Aug 8, 2025
Thanks @someguynamedjosh !
Any chance this can get merged into Python @AlexWaygood? This is a bug and the PR has been sitting around for years. Anything I can do to make it happen?
AlexWaygood commentedon Aug 8, 2025
I'm afraid I don't really know anything about the internals of the shutil module and haven't got much spare time for CPython development these days!
You might find this page of the devguide helpful: https://devguide.python.org/getting-started/pull-request-lifecycle/#pull-request-lifecycle. You can also consider posting something on Discourse similar to this: https://discuss.python.org/t/request-for-merge-fix-http-cookies-module-to-support-obsolete-rfc-850-date-format/73944
picnixz commentedon Aug 8, 2025
I can see how
..inside the name is actually wrongly interpreted. However, considering this may changes an existing (wrong) behavior, I think it's better if we:..in shutil.unpack_archive: we would still skip files that are absolute or relative (so with.startswith(('/', '../')), but we would not delegate tozipfile.mainbranch, we could tozipfile. But before that, we will need a separate discussion, likely a DPO one.serhiy-storchaka commentedon May 18, 2026
This was fixed in #146591.