Skip to content

[3.15] gh-161705: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (GH-161706) - #161717

Merged
vstinner merged 1 commit into
python:3.15from
miss-islington:backport-e891a91-3.15
Nov 10, 2026
Merged

vstinner merged 1 commit into
python:3.15from
miss-islington:backport-e891a91-3.15

Conversation

@miss-islington

@miss-islington miss-islington commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

  • Add sys._path0 variable.
  • pymain_sys_path_add_path0() sets sys._path0.
  • Add runpy._remove_sys_path0().
  • gzip, tarfile and zipfile main functions now call
    _remove_sys_path0() to prevent shadowing stdlib modules from
    extracted files.
    (cherry picked from commit e891a91)

Co-authored-by: Victor Stinner vstinner@python.org
Co-authored-by: Gregory P. Smith 68491+gpshead@users.noreply.github.com
Co-authored-by: Ethan Furman ethan@stoneleaf.us
Co-authored-by: Kirill Podoprigora kirill.bast9@mail.ru

…pythonGH-161706)

Remove sys.path[0] in gzip, tarfile and zipfile command line
interface to prevent shadowing standard library modules from
extracted files.

* Add sys._path0 variable.
* pymain_sys_path_add_path0() sets sys._path0.
* Add runpy._remove_sys_path0().
* gzip, tarfile and zipfile main functions now call
  _remove_sys_path0() to prevent shadowing stdlib modules from
  extracted files.
(cherry picked from commit e891a9117985888df3e5d48145cf07ddda098335)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
@read-the-docs-community

Copy link
Copy Markdown

@vstinner
vstinner enabled auto-merge (squash) November 9, 2026 23:59
@vstinner
vstinner merged commit 673607e into python:3.15 Nov 10, 2026
61 checks passed
@miss-islington
miss-islington deleted the backport-e891a91-3.15 branch November 10, 2026 00:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants