bpo-20907: shutil._unpack_zipfile add warnings for skipped files

Doc/library/shutil.rst

@@ -657,6 +657,10 @@ provided.  They rely on the :mod:`zipfile` and :mod:`tarfile` modules.
    registered for that extension.  In case none is found,
    a :exc:`ValueError` is raised.
 
+   Note that with *zip* format, absolute paths and paths containing a ``..``
+   component, are not extracted. If you need such paths extracted, consider
+   using :func:`ZipFile.extractall`.
+
    .. audit-event:: shutil.unpack_archive filename,extract_dir,format shutil.unpack_archive
 
    .. versionchanged:: 3.7

Lib/shutil.py

@@ -10,6 +10,7 @@
 import fnmatch
 import collections
 import errno
+import logging
 
 try:
     import zlib
@@ -1164,12 +1165,14 @@ def _unpack_zipfile(filename, extract_dir):
         raise ReadError("%s is not a zip file" % filename)
 
     zip = zipfile.ZipFile(filename)
+    skipped = 0
     try:
         for info in zip.infolist():
             name = info.filename
 
             # don't extract absolute paths or ones with .. in them
             if name.startswith('/') or '..' in name:
+                skipped += 1
                 continue
 
             targetpath = os.path.join(extract_dir, *name.split('/'))
@@ -1183,6 +1186,11 @@ def _unpack_zipfile(filename, extract_dir):
                         open(targetpath, 'wb') as target:
                     copyfileobj(source, target)
     finally:
+        if skipped:
+            import logging
+            logging.getLogger(__file__)
+            logging.warning(f'unpack {filename}: {skipped} file(s) skipped'
+                          ' (due to absolute path or `..` path component)')
         zip.close()
 
 def _unpack_tarfile(filename, extract_dir):

Lib/test/test_shutil.py

@@ -1610,6 +1610,14 @@ def check_unpack_archive_with_converter(self, format, converter):
         self.assertRaises(shutil.ReadError, unpack_archive, converter(TESTFN))
         self.assertRaises(ValueError, unpack_archive, converter(TESTFN), format='xxx')
 
+    def test_unpack_archive_zip_warn_skipped(self):
+        tmpdir2 = self.mkdtemp()
+        with self.assertLogs(level='WARNING') as cm:
+            fn = support.findfile("testzip.zip")
+            unpack_archive(pathlib.Path(fn), pathlib.Path(tmpdir2))
+        self.assertIn('1 file(s) skipped', cm.output[0])
+        self.assertEqual(rlistdir(tmpdir2), ['test'])
+
     def test_unpack_archive_tar(self):
         self.check_unpack_archive('tar')
 

Misc/NEWS.d/next/Library/2021-12-03-19-05-39.bpo-20907.f1_XQ1.rst

@@ -0,0 +1,2 @@
+Added warning for skipped files in :func:`shutil.unpack_archive` using *zip*
+format.