[StanFromIreland]

• Issue: tarfile filter bypass: euc_kr make-up sequences let realpath() and the kernel disagree, writing files outside the destination #160717

[StanFromIreland]

@corona10 is it ok to merge the patch, I can wait a little longer if you'd like to review?

[corona10]

Still concern with old documentation that were not generated by Python. EUC-KR is still standard in banking system, but betting low possibility in actual regression in practice.

[StanFromIreland]

Unfortunately I don't see a way around this. We could leave the codec alone and make tarfile's path check operate on bytes. That isn't ideal in itself, and it only fixes tarfile, os.fsdecode() followed by os.fsencode() would still return different bytes on EUC-KR hosts, so os.path.realpath(), pathlib.Path.resolve(), shutil and any other str-based path check keep the same flaw. I agree the regression risk isn't zero, but it looks small, I think a potential path-escape vulnerability (which could affect those banking systems you noted) has to outweigh some breakage for a rare input.

But, I'm not all that familiar here, so maybe you have a different solution in mind?