From 978407c938057b2e7d1bad3186fa7d102fffc9c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Chaves?= Date: Wed, 13 Dec 2023 13:42:37 +0100 Subject: [PATCH] Warn against using scrapy.downloadermiddlewares.decompression --- docs/news.rst | 6 ++++++ scrapy/downloadermiddlewares/decompression.py | 11 +++++++++++ 2 files changed, 17 insertions(+) diff --git a/docs/news.rst b/docs/news.rst index 4de283ddf..1ecc81ae7 100644 --- a/docs/news.rst +++ b/docs/news.rst @@ -17,6 +17,12 @@ Scrapy 1.8.4 (unreleased) to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security advisory`_ for more information. + .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 + +- Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the + ``scrapy.downloadermiddlewares.decompression`` module is discouraged and + will trigger a warning. + .. _release-1.8.3: diff --git a/scrapy/downloadermiddlewares/decompression.py b/scrapy/downloadermiddlewares/decompression.py index 49313cc04..5e9e9bc48 100644 --- a/scrapy/downloadermiddlewares/decompression.py +++ b/scrapy/downloadermiddlewares/decompression.py @@ -8,6 +8,7 @@ import zipfile import tarfile import logging from tempfile import mktemp +from warnings import warn import six @@ -16,8 +17,18 @@ try: except ImportError: from io import BytesIO +from scrapy.exceptions import ScrapyDeprecationWarning from scrapy.responsetypes import responsetypes +warn( + "Use of the scrapy.downloadermiddlewares.decompression module is " + "discouraged, as it is susceptible to decompression bomb attacks. For " + "details, see " + "https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7", + ScrapyDeprecationWarning, + stacklevel=2, +) + logger = logging.getLogger(__name__)