From a8320d9b61a8dc6c1c7007d0e95c25898a286671 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 11 May 2026 15:28:48 +0000 Subject: [PATCH] Fix safe_extract_tarball: pass safe_members to extractall on Python 3.12+ --- src/specify_cli/extensions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/specify_cli/extensions.py b/src/specify_cli/extensions.py index 92c58ae7d..0247703d2 100644 --- a/src/specify_cli/extensions.py +++ b/src/specify_cli/extensions.py @@ -227,10 +227,10 @@ def safe_extract_tarball( safe_members.append(member) # Extract — use the "data" filter on Python 3.12+ for extra hardening. - # On older versions pass only the pre-validated members so that no + # On all versions pass only the pre-validated members so that no # unvetted entry (added concurrently or via a race) slips through. if sys.version_info >= (3, 12): - tf.extractall(dest_dir, filter="data") # type: ignore[call-arg] + tf.extractall(dest_dir, members=safe_members, filter="data") # type: ignore[call-arg] else: tf.extractall(dest_dir, members=safe_members) # noqa: S202 — validated above except error_class: