gh-157190: Follow symlinks when extracting tarfile hard links

[StanFromIreland]

• Issue: tarfile data/tar filter bypass via hard link to a symlink #157190

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @StanFromIreland for commit 027cfba 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F157191%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[encukou]

LGTM; let's merge if the buildbots or the 3.13 backport don't fail in tarfile.
When merging: the commit message should mention that the fixed bug only exists in 3.13 and below.

[maurycy]

Do we want to test also a symlink pointing to a directory?

[StanFromIreland]

I'm not sure what that would be testing, a hard link to a directory isn't possible.

[maurycy]

I meant a hard link to the symlink, where the symlink points to a directory.

Something like that:

2026-09-09T17:26:21.505759000+0200 maurycy@gimel /tmp/tarararara  % tar tvf evil.tar
drw-r--r--  0 0      0           0 Jan  1  1970 a/d/
-rw-r--r--  0 0      0           5 Jan  1  1970 a/d/f
lrw-r--r--  0 0      0           0 Jan  1  1970 a/b/s -> ../d
hrw-r--r--  0 0      0           0 Jan  1  1970 s link to a/b/s

[StanFromIreland]

os.link() raises on a directory, so it falls through to the fallback branch, which is the path test_sneaky_hardlink_fallback_deep covers.

[miss-islington-app]

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

[miss-islington-app]

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

[bedevere-app]

GH-157261 is a backport of this pull request to the 3.14 branch.

[bedevere-app]

GH-157262 is a backport of this pull request to the 3.15 branch.

[bedevere-bot]

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot PPC64LE Fedora Stable LTO + PGO 3.13 (tier-2) has failed when building commit b8f23e3.

What do you need to do:

1. Don't panic.
2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1494/builds/1358) and take a look at the build logs.
4. Check if the failure is related to this commit (b8f23e3) or if it is a false positive.
5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1494/builds/1358

Failed tests:

• test_smtpnet

Failed subtests:

• test_explicit_connect_host_port_starttls - test.test_smtpnet.SmtpTest.test_explicit_connect_host_port_starttls
• test_connect_host_port_starttls - test.test_smtpnet.SmtpTest.test_connect_host_port_starttls

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/test/test_smtpnet.py", line 54, in test_connect_host_port_starttls
    server = smtplib.SMTP(f'{self.testServer}:{self.remotePort}')
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/smtplib.py", line 266, in __init__
    raise SMTPConnectError(code, msg)
smtplib.SMTPConnectError: (421, b'4.4.5 Server busy, try again later. (smtp.gmail.com)\n4.4.5  For more information, go to\n4.4.5  https://support.google.com/a/answer/3221692 5b1f17b1804b1-49d1fb058c9sm1436945e9.0 - gsmtp')


Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/test/test_smtpnet.py", line 92, in test_explicit_connect_host_port_starttls
    server.starttls(context=context)
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/smtplib.py", line 783, in starttls
    self.ehlo_or_helo_if_needed()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/smtplib.py", line 620, in ehlo_or_helo_if_needed
    if not (200 <= self.ehlo()[0] <= 299):
                   ~~~~~~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/smtplib.py", line 461, in ehlo
    (code, msg) = self.getreply()
                  ~~~~~~~~~~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-ppc64le/3.13.cstratak-fedora-stable-ppc64le.lto-pgo/build/Lib/smtplib.py", line 414, in getreply
    raise SMTPServerDisconnected("Connection unexpectedly closed")
smtplib.SMTPServerDisconnected: Connection unexpectedly closed