diff --git a/docs/news.rst b/docs/news.rst index 4de283ddf..1ecc81ae7 100644 --- a/docs/news.rst +++ b/docs/news.rst @@ -17,6 +17,12 @@ Scrapy 1.8.4 (unreleased) to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security advisory`_ for more information. + .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 + +- Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the + ``scrapy.downloadermiddlewares.decompression`` module is discouraged and + will trigger a warning. + .. _release-1.8.3: diff --git a/scrapy/downloadermiddlewares/decompression.py b/scrapy/downloadermiddlewares/decompression.py index 49313cc04..5e9e9bc48 100644 --- a/scrapy/downloadermiddlewares/decompression.py +++ b/scrapy/downloadermiddlewares/decompression.py @@ -8,6 +8,7 @@ import zipfile import tarfile import logging from tempfile import mktemp +from warnings import warn import six @@ -16,8 +17,18 @@ try: except ImportError: from io import BytesIO +from scrapy.exceptions import ScrapyDeprecationWarning from scrapy.responsetypes import responsetypes +warn( + "Use of the scrapy.downloadermiddlewares.decompression module is " + "discouraged, as it is susceptible to decompression bomb attacks. For " + "details, see " + "https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7", + ScrapyDeprecationWarning, + stacklevel=2, +) + logger = logging.getLogger(__name__)