github/github-spec-kit
1
0
Fork 0
mirror of https://github.com/github/spec-kit.git synced 2026-07-06 22:32:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix safe_extract_tarball: pass safe_members to extractall on Python 3.12+

Browse Source
This commit is contained in:
copilot-swe-agent[bot]
2026-05-11 15:28:48 +00:00
committed by GitHub
parent 0825f508a7
commit a8320d9b61
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/specify_cli/extensions.py
View File

@@ -227,10 +227,10 @@ def safe_extract_tarball(
safe_members.append(member)
# Extract — use the "data" filter on Python 3.12+ for extra hardening.
# On older versions pass only the pre-validated members so that no
# On all versions pass only the pre-validated members so that no
# unvetted entry (added concurrently or via a race) slips through.
if sys.version_info >= (3, 12):
tf.extractall(dest_dir, filter="data") # type: ignore[call-arg]
tf.extractall(dest_dir, members=safe_members, filter="data") # type: ignore[call-arg]
else:
tf.extractall(dest_dir, members=safe_members) # noqa: S202 — validated above
except error_class: