My implementation of PEP-706 has a bug: it wrongly determines the target of symlinks, and thus wrongly raises LinkOutsideDestinationError on some valid tarballs.
I didn't pay enough attention to this quirk of the format (which I'd like to add to TarInfolinkname docs):
For symbolic links (SYMTYPE), the linkname is relative to the directory that contains the link.
For hard links (LNKTYPE), the linkname is relative to the root of the archive.
So, in a tarball that contains the following, the links point to dir/target:
dir/target
other_dir/symlink -> ../dir/target
other_dir/hardlink -> dir/target
But data_filter thinks that other_dir/symlink will point to ../dir target outside the destination directory.
I have a fix but would like to test it more next week, before merging.
Sorry for the extra work this'll cause for a lot of people :(
Linked PRs
My implementation of PEP-706 has a bug: it wrongly determines the target of symlinks, and thus wrongly raises
LinkOutsideDestinationErroron some valid tarballs.I didn't pay enough attention to this quirk of the format (which I'd like to add to TarInfolinkname docs):
So, in a tarball that contains the following, the links point to
dir/target:dir/targetother_dir/symlink->../dir/targetother_dir/hardlink->dir/targetBut
data_filterthinks thatother_dir/symlinkwill point to../dir targetoutside the destination directory.I have a fix but would like to test it more next week, before merging.
Sorry for the extra work this'll cause for a lot of people :(
Linked PRs