zipfile - extract truncates (existing) file when bad password provided (zip encryption weakness)
Open
Nobody has claimed this yet.
stdlib
type-feature
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 36k
- PR merge metrics
- PR metrics pending
Description
| BPO | 36247 |
|---|---|
| Nosy | @Yhg1s, @ned-deily, @serhiy-storchaka, @CristiFati |
| PRs |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2019-03-08.22:56:50.804>
labels = ['3.8', 'type-bug', 'library']
title = 'zipfile - extract truncates (existing) file when bad password provided (zip encryption weakness)'
updated_at = <Date 2019-03-18.02:02:48.092>
user = 'https://github.com/CristiFati'
bugs.python.org fields:
activity = <Date 2019-03-18.02:02:48.092>
actor = 'ned.deily'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2019-03-08.22:56:50.804>
creator = 'CristiFati'
dependencies = []
files = []
hgrepos = []
issue_num = 36247
keywords = ['patch']
message_count = 5.0
messages = ['337543', '337545', '337570', '337610', '338155']
nosy_count = 5.0
nosy_names = ['twouters', 'alanmcintyre', 'ned.deily', 'serhiy.storchaka', 'CristiFati']
pr_nums = ['12242']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue36247'
versions = ['Python 3.8']
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Python's zipfile extract path and review how a bad password is handled when the destination file already exists. Compare the current behavior with the issue's expected outcome: an incorrect password must not truncate the existing file. PR #12242 is referenced in the issue, so check that work before starting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100