diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index f1c7dbbab40e798..1b2c328f9cad9f6 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1137,17 +1137,13 @@ reused in custom filters: Return the modified ``TarInfo`` member. .. warning:: - This filter does not check :attr:`TarInfo.linkname`. This means it does - not limit where a symbolic link member points. An absolute symbolic-link - target will remain absolute, and a relative target may resolve outside the - extraction destination. The destination path protection described above - concerns only where the archive member itself is written, not where a - symbolic link resolves. The stricter :func:`data_filter` rejects these - unsafe link targets, raising :class:`~tarfile.AbsoluteLinkError` for - absolute link targets or :class:`~tarfile.LinkOutsideDestinationError` - for link targets outside the destination. - - .. versionchanged:: 3.16 + + This filter does not check link targets (:attr:`TarInfo.linkname`). + It allows benign cases (like links to ``/dev/null``), but it also allows + links (symbolic and hard) to arbitrary files on the filesystem, + potentially granting unintended access to these files. + + .. versionchanged:: next Filenames containing ``..`` components are now normalized.