gh-138158: Use the 'data' tarfile filter for multissltests

[ParzivalHack]

This pull request addresses a path traversal vulnerability in the Tools/ssl/multissltests.py script. The vulnerability allows for a crafted tarball to write an arbitrary file to a location outside of the intended build directory due to a lack of sanitization in the _unpack_src method's handling of tarball member names.

A comprehensive, self-contained PoC script was used to demonstrate the issue (and shared with the PSRT), confirming the Path Traversal. The fix implemented in this PR ensures that each tarball member is manually extracted with a path check, preventing any file from escaping the designated directory. This approach provides a clear and robust solution to the issue.

As this is a test script, and not a production component, the Python Security Response Team (PSRT) has advised me to submitt it as a public enhancement. This fix ensures the integrity and robustness of the tool, by preventing an unprivileged file write that could lead to unexpected behavior.

I am submitting this enhancement to improve the overall quality of the CPython test suite. If necessary, I'm available to provide any additional information required for review.

• Issue: Fix Path Traversal in multissltests.py #138158

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[AA-Turner]

It seems you have several unrelated whitespace changes; please revert.

A

[bedevere-app]

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

[StanFromIreland]

FYI These are the whitespace changes that should be reverted:

[ParzivalHack]

I have made the requested changes; please review again

[bedevere-app]

Thanks for making the requested changes!

@AA-Turner: please review the changes made to this pull request.

[picnixz]

This PR overcomplicates a script that is already complex. The URLs are safe as they are hardcoded. I don't think we need to worry about this kind of attack, unless upstream is affected (namely official openssl, libressl or aws-lc repositories).

Has this PR been generated by AI?

[picnixz]

Whatever we choose to do, an issue should be opened first. However, I don't think such change is needed, but to be on the perfectly safe side, we could just specify the filter in extractall.

[bedevere-app]

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

[ParzivalHack]

I have made the requested changes; please review again

[bedevere-app]

Thanks for making the requested changes!

@AA-Turner, @picnixz: please review the changes made to this pull request.

[picnixz]

Could you open an issue as well? TiA.

Changes were made.

[picnixz]

I will be leaving soon and will only come back on Thursday so I won't be able to check/merge this one.

[AA-Turner]

Using the data filter seems harmless. I agree with Ben (& the PSRT) though that there is no practical 'vulnerability' here, so this is largely a change for theoretical purposes. As such, I'm +0; will leave to someone else to decide to merge.

A

+0