python / python/cpython

`zipfile` append corrupts a file due to auto filename sanitization

未关闭
#153,625 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

stdlib type-bug
主要语言
Python
星标
77.2k
派生
35.9k
PR 合并指标
PR 指标待抓取

描述

Bug report

Bug description:

When a ZIP archive is opened and rewritten in append mode, a member having a non-standard filename will be corrupted because its filename rewritten to the central directory is auto-sanitized and thus inconsistent with the immutable local file entry when loaded in the future.

This can easily happen if a member containing \ is added in POSIX and the archive is then appended in Windows.

For example:

import io
import zipfile
from unittest import mock

TESTFN = io.BytesIO()

# A file written in POSIX allows '\\'
with mock.patch('os.sep', '/'), mock.patch('os.altsep', None), \
     zipfile.ZipFile(TESTFN, mode="w") as zipfp:
    zi = zipfile.ZipInfo('MyFolder/My\\File.txt')
    zipfp.writestr(zi, 'foo')

# A file written in Windows has '\\' replaced with '/'
with mock.patch('os.sep', '\\'), mock.patch('os.altsep', '/'), \
     zipfile.ZipFile(TESTFN, "a") as zipfp:
    # trigger archive rewriting
    zipfp.comment = b''

with zipfile.ZipFile(TESTFN, "r") as zipfp:
    zi = zipfp.infolist()[0]
    print('content:', zipfp.read(zi))

The above code raises an error: zipfile.BadZipFile: File name in directory 'MyFolder/My/File.txt' and header b'MyFolder/My\\File.txt' differ.

CPython versions tested on:

3.16, 3.14

Operating systems tested on:

No response

Linked PRs
  • gh-153626

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

调研方向

先运行 issue 中的 reproducer,并检查 Python 的 zipfile 追加模式归档重写和文件名清理路径。完成标准是:使用包含反斜杠的 member 创建的归档可以追加内容并在之后读取,且目录文件名与 header 文件名之间不存在不匹配;该 issue 链接了 PR gh-153626,因此先检查这项工作。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
backend
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。