diff options
| author | JunWei Song <sungboss2004@gmail.com> | 2019-09-11 23:04:12 +0800 |
|---|---|---|
| committer | Jason R. Coombs <jaraco@jaraco.com> | 2019-09-11 16:04:11 +0100 |
| commit | 3ba51d587f6897a45301ce9126300c14fcd4eba2 (patch) | |
| tree | d1cf636c71981d4ca5f884d981538b37e18212f1 | |
| parent | 5209e586b7cac9a43b2c44349a26b1b0af06ead3 (diff) | |
| download | cpython-git-3ba51d587f6897a45301ce9126300c14fcd4eba2.tar.gz | |
bpo-36260: Add pitfalls to zipfile module documentation (#13378)
* bpo-36260: Add pitfalls to zipfile module documentation
We saw vulnerability warning description (including zip bomb) in Doc/library/xml.rst file.
This gave us the idea of documentation improvement.
So, we moved a little bit forward :P
And the doc patch can be found (pr).
* fix trailing whitespace
* 📜🤖 Added by blurb_it.
* Reformat text for consistency.
| -rw-r--r-- | Doc/library/zipfile.rst | 40 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst | 1 |
2 files changed, 41 insertions, 0 deletions
diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst index 9db9697105..18d2e9a60a 100644 --- a/Doc/library/zipfile.rst +++ b/Doc/library/zipfile.rst @@ -816,5 +816,45 @@ Command-line options Test whether the zipfile is valid or not. +Decompression pitfalls +---------------------- + +The extraction in zipfile module might fail due to some pitfalls listed below. + +From file itself +~~~~~~~~~~~~~~~~ + +Decompression may fail due to incorrect password / CRC checksum / ZIP format or +unsupported compression method / decryption. + +File System limitations +~~~~~~~~~~~~~~~~~~~~~~~ + +Exceeding limitations on different file systems can cause decompression failed. +Such as allowable characters in the directory entries, length of the file name, +length of the pathname, size of a single file, and number of files, etc. + +Resources limitations +~~~~~~~~~~~~~~~~~~~~~ + +The lack of memory or disk volume would lead to decompression +failed. For example, decompression bombs (aka `ZIP bomb`_) +apply to zipfile library that can cause disk volume exhaustion. + +Interruption +~~~~~~~~~~~~ + +Interruption during the decompression, such as pressing control-C or killing the +decompression process may result in incomplete decompression of the archive. + +Default behaviors of extraction +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Not knowing the default extraction behaviors +can cause unexpected decompression results. +For example, when extracting the same archive twice, +it overwrites files without asking. + +.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb .. _PKZIP Application Note: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT diff --git a/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst b/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst new file mode 100644 index 0000000000..9276516a88 --- /dev/null +++ b/Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst @@ -0,0 +1 @@ +Add decompression pitfalls to zipfile module documentation.
\ No newline at end of file |