Skip to content

Commit a334ec0

Browse files
serhiy-storchakaserhiy-storchaka
committed
Emit a warning instead of raising an exception.
1 parent f78a6f4 commit a334ec0

File tree

3 files changed

+90
-3
lines changed

3 files changed

+90
-3
lines changed

‎Lib/test/test_zipfile/test_core.py‎

Lines changed: 78 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2443,6 +2443,37 @@ def test_full_overlap_different_names(self):
24432443
with self.assertRaisesRegex(zipfile.BadZipFile, 'File name.*differ'):
24442444
zipf.read('a')
24452445

2446+
@requires_zlib()
2447+
def test_full_overlap_different_names2(self):
2448+
data = (
2449+
b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e'
2450+
b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00a\xed'
2451+
b'\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\d\x0b`P'
2452+
b'K\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2'
2453+
b'\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00'
2454+
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00aPK'
2455+
b'\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e'
2456+
b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00\x00'
2457+
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00bPK\x05'
2458+
b'\x06\x00\x00\x00\x00\x02\x00\x02\x00^\x00\x00\x00/\x00\x00'
2459+
b'\x00\x00\x00'
2460+
)
2461+
with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf:
2462+
self.assertEqual(zipf.namelist(), ['a', 'b'])
2463+
zi = zipf.getinfo('a')
2464+
self.assertEqual(zi.header_offset, 0)
2465+
self.assertEqual(zi.compress_size, 16)
2466+
self.assertEqual(zi.file_size, 1033)
2467+
zi = zipf.getinfo('b')
2468+
self.assertEqual(zi.header_offset, 0)
2469+
self.assertEqual(zi.compress_size, 16)
2470+
self.assertEqual(zi.file_size, 1033)
2471+
with self.assertRaisesRegex(zipfile.BadZipFile, 'File name.*differ'):
2472+
zipf.read('b')
2473+
with self.assertWarnsRegex(UserWarning, 'Overlapped entries') as cm:
2474+
self.assertEqual(len(zipf.read('a')), 1033)
2475+
self.assertEqual(cm.filename, __file__)
2476+
24462477
@requires_zlib()
24472478
def test_full_overlap_same_name(self):
24482479
data = (
@@ -2468,8 +2499,12 @@ def test_full_overlap_same_name(self):
24682499
self.assertEqual(len(zipf.read('a')), 1033)
24692500
self.assertEqual(len(zipf.read(zi)), 1033)
24702501
self.assertEqual(len(zipf.read(zipf.infolist()[1])), 1033)
2471-
with self.assertRaisesRegex(zipfile.BadZipFile, 'Overlapped entries'):
2472-
zipf.read(zipf.infolist()[0])
2502+
with self.assertWarnsRegex(UserWarning, 'Overlapped entries') as cm:
2503+
self.assertEqual(len(zipf.read(zipf.infolist()[0])), 1033)
2504+
self.assertEqual(cm.filename, __file__)
2505+
with self.assertWarnsRegex(UserWarning, 'Overlapped entries') as cm:
2506+
zipf.open(zipf.infolist()[0]).close()
2507+
self.assertEqual(cm.filename, __file__)
24732508

24742509
@requires_zlib()
24752510
def test_quoted_overlap(self):
@@ -2502,6 +2537,47 @@ def test_quoted_overlap(self):
25022537
zipf.read('a')
25032538
self.assertEqual(len(zipf.read('b')), 1033)
25042539

2540+
@requires_zlib()
2541+
def test_overlap_with_central_dir(self):
2542+
data = (
2543+
b'PK\x01\x02\x14\x03\x14\x00\x00\x00\x08\x00G_|Z'
2544+
b'\xe2\x1e8\xbb\x0b\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00'
2545+
b'\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x81\x00\x00\x00\x00aP'
2546+
b'K\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00/\x00\x00\x00\x00'
2547+
b'\x00\x00\x00\x00\x00'
2548+
)
2549+
with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf:
2550+
self.assertEqual(zipf.namelist(), ['a'])
2551+
self.assertEqual(len(zipf.infolist()), 1)
2552+
zi = zipf.getinfo('a')
2553+
self.assertEqual(zi.header_offset, 0)
2554+
self.assertEqual(zi.compress_size, 11)
2555+
self.assertEqual(zi.file_size, 1033)
2556+
with self.assertRaisesRegex(zipfile.BadZipFile, 'Bad magic number'):
2557+
zipf.read('a')
2558+
2559+
@requires_zlib()
2560+
def test_overlap_with_archive_comment(self):
2561+
data = (
2562+
b'PK\x01\x02\x14\x03\x14\x00\x00\x00\x08\x00G_|Z'
2563+
b'\xe2\x1e8\xbb\x0b\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00'
2564+
b'\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x81E\x00\x00\x00aP'
2565+
b'K\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00/\x00\x00\x00\x00'
2566+
b'\x00\x00\x00*\x00'
2567+
b'PK\x03\x04\x14\x00\x00\x00\x08\x00G_|Z\xe2\x1e'
2568+
b'8\xbb\x0b\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00aK'
2569+
b'L\x1c\x05\xa3`\x14\x8cx\x00\x00'
2570+
)
2571+
with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf:
2572+
self.assertEqual(zipf.namelist(), ['a'])
2573+
self.assertEqual(len(zipf.infolist()), 1)
2574+
zi = zipf.getinfo('a')
2575+
self.assertEqual(zi.header_offset, 69)
2576+
self.assertEqual(zi.compress_size, 11)
2577+
self.assertEqual(zi.file_size, 1033)
2578+
with self.assertRaisesRegex(zipfile.BadZipFile, 'Overlapped entries'):
2579+
zipf.read('a')
2580+
25052581
def tearDown(self):
25062582
unlink(TESTFN)
25072583
unlink(TESTFN2)

‎Lib/zipfile/__init__.py‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1708,7 +1708,16 @@ def open(self, name, mode="r", pwd=None, *, force_zip64=False):
17081708

17091709
if (zinfo._end_offset is not None and
17101710
zef_file.tell() + zinfo.compress_size > zinfo._end_offset):
1711-
raise BadZipFile(f"Overlapped entries: {zinfo.orig_filename!r} (possible zip bomb)")
1711+
if zinfo._end_offset == zinfo.header_offset:
1712+
import warnings
1713+
warnings.warn(
1714+
f"Overlapped entries: {zinfo.orig_filename!r} "
1715+
f"(possible zip bomb)",
1716+
skip_file_prefixes=(os.path.dirname(__file__),))
1717+
else:
1718+
raise BadZipFile(
1719+
f"Overlapped entries: {zinfo.orig_filename!r} "
1720+
f"(possible zip bomb)")
17121721

17131722
# check for encrypted flag & handle password
17141723
is_encrypted = zinfo.flag_bits & _MASK_ENCRYPTED

‎Misc/NEWS.d/next/Library/2025-01-24-12-30-38.gh-issue-117779.gADGXI.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
Fix reading duplicated entries in :mod:`zipfile` by name.
2+
Reading duplicated entries (except the last one) by ``ZipInfo``
3+
now emits a warning instead of raising an exception.

0 commit comments

Comments
 (0)