From f04ef07ac7aea48e8256fdd55f1a8332743bdb3d Mon Sep 17 00:00:00 2001
From: Danny Lin <danny0838@gmail.com>
Date: Tue, 14 Jul 2026 22:32:40 +0800
Subject: [PATCH 1/2] gh-153702: Prevent writing improper extra fields to local
 file entry

---
 Lib/test/test_zipfile/test_core.py            | 47 +++++++++++++++++++
 Lib/zipfile/__init__.py                       | 17 +++++--
 ...-07-14-22-25-00.gh-issue-153702.000000.rst |  3 ++
 3 files changed, 64 insertions(+), 3 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-07-14-22-25-00.gh-issue-153702.000000.rst

diff --git a/Lib/test/test_zipfile/test_core.py b/Lib/test/test_zipfile/test_core.py
index 4f20209927e7b3..8da33ab0951580 100644
--- a/Lib/test/test_zipfile/test_core.py
+++ b/Lib/test/test_zipfile/test_core.py
@@ -1189,6 +1189,53 @@ def test_generated_valid_zip64_extra(self):
                     self.assertEqual(zinfo.header_offset, expected_header_offset)
                     self.assertEqual(zf.read(zinfo), expected_content)
 
+    def test_generated_extra_in_local_entry(self):
+        """Should not write duplicated or improper fields to local file entry."""
+        # zip64
+        fh = io.BytesIO()
+        with zipfile.ZipFile(fh, 'w') as zh:
+            zinfo = zipfile.ZipInfo('strfile')
+            zinfo.extra = (
+                # zip64
+                struct.pack('<HHQQ', 0x0001, 16, 0, 0) +
+                # unicode comment
+                struct.pack('<HHBL5s', 0x6375, 10, 1,
+                            zipfile.crc32(b'\u4e00'), b'\u4e00') +
+                # invalid tail
+                b'zzz'
+            )
+            zh.writestr(zinfo, self.data)
+
+        fh.seek(zinfo.header_offset)
+        entry = fh.read(zh.start_dir - zinfo.header_offset - zinfo.compress_size)
+        header = struct.unpack_from(zipfile.structFileHeader, entry)
+        extra = entry[-header[zipfile._FH_EXTRA_FIELD_LENGTH]:]
+        self.assertEqual(extra, (
+            struct.pack('<HHQQ', 0x0001, 16, 25889, 25889) +
+            b'zzz'
+        ))
+
+        # no zip64
+        fh = io.BytesIO()
+        with zipfile.ZipFile(fh, 'w') as zh:
+            zinfo = zipfile.ZipInfo('strfile')
+            zinfo.extra = (
+                # zip64
+                struct.pack('<HHQQ', 0x0001, 16, 0, 0) +
+                # unicode comment
+                struct.pack('<HHBL5s', 0x6375, 10, 1,
+                            zipfile.crc32(b'\u4e00'), b'\u4e00') +
+                # invalid tail
+                b'zzz'
+            )
+            zh.writestr(zinfo, 'foo')
+
+        fh.seek(zinfo.header_offset)
+        entry = fh.read(zh.start_dir - zinfo.header_offset - zinfo.compress_size)
+        header = struct.unpack_from(zipfile.structFileHeader, entry)
+        extra = entry[-header[zipfile._FH_EXTRA_FIELD_LENGTH]:]
+        self.assertEqual(extra, b'zzz')
+
     def test_force_zip64(self):
         """Test that forcing zip64 extensions correctly notes this in the zip file"""
 
diff --git a/Lib/zipfile/__init__.py b/Lib/zipfile/__init__.py
index 418933a2e8d9e8..4c30968494f47e 100644
--- a/Lib/zipfile/__init__.py
+++ b/Lib/zipfile/__init__.py
@@ -541,7 +541,7 @@ def FileHeader(self, zip64=None):
             compress_size = self.compress_size
             file_size = self.file_size
 
-        extra = self.extra
+        extra = self._get_local_extra()
 
         min_version = 0
         if zip64 is None:
@@ -550,8 +550,11 @@ def FileHeader(self, zip64=None):
             zip64 = file_size > ZIP64_LIMIT or compress_size > ZIP64_LIMIT
         if zip64:
             fmt = '<HHQQ'
-            extra = extra + struct.pack(fmt,
-                                        1, struct.calcsize(fmt)-4, file_size, compress_size)
+            extra = struct.pack(
+                fmt, 1, struct.calcsize(fmt)-4,
+                file_size, compress_size
+            ) + extra
+
             file_size = 0xffffffff
             compress_size = 0xffffffff
             min_version = ZIP64_VERSION
@@ -628,6 +631,14 @@ def _decodeExtra(self, filename_crc):
 
             extra = extra[ln+4:]
 
+    def _get_local_extra(self):
+        return _Extra.strip(self.extra, (
+            # should be added on demand later
+            0x0001,  # Zip64
+            # should only exist in central directory
+            0x6375,  # Unicode Comment
+        ))
+
     @classmethod
     def from_file(cls, filename, arcname=None, *, strict_timestamps=True):
         """Construct an appropriate ZipInfo for a file on the filesystem.
diff --git a/Misc/NEWS.d/next/Library/2026-07-14-22-25-00.gh-issue-153702.000000.rst b/Misc/NEWS.d/next/Library/2026-07-14-22-25-00.gh-issue-153702.000000.rst
new file mode 100644
index 00000000000000..add6fc241ea63c
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-14-22-25-00.gh-issue-153702.000000.rst
@@ -0,0 +1,3 @@
+Fix an issue where duplicated or improper extra fields were written to
+the local file entry if :attr:`ZipInfo.extra <zipfile.ZipInfo.extra>`
+had them.

From c69cf30fafc9c2bb638326afc9ec15a3f34e5f33 Mon Sep 17 00:00:00 2001
From: Danny Lin <danny0838@gmail.com>
Date: Tue, 14 Jul 2026 22:51:28 +0800
Subject: [PATCH 2/2] Fix encoding error

---
 Lib/test/test_zipfile/test_core.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Lib/test/test_zipfile/test_core.py b/Lib/test/test_zipfile/test_core.py
index 8da33ab0951580..441508518d01d6 100644
--- a/Lib/test/test_zipfile/test_core.py
+++ b/Lib/test/test_zipfile/test_core.py
@@ -1191,6 +1191,8 @@ def test_generated_valid_zip64_extra(self):
 
     def test_generated_extra_in_local_entry(self):
         """Should not write duplicated or improper fields to local file entry."""
+        comment = '\u4e00'.encode('utf-8')
+
         # zip64
         fh = io.BytesIO()
         with zipfile.ZipFile(fh, 'w') as zh:
@@ -1200,7 +1202,7 @@ def test_generated_extra_in_local_entry(self):
                 struct.pack('<HHQQ', 0x0001, 16, 0, 0) +
                 # unicode comment
                 struct.pack('<HHBL5s', 0x6375, 10, 1,
-                            zipfile.crc32(b'\u4e00'), b'\u4e00') +
+                            zipfile.crc32(comment), comment) +
                 # invalid tail
                 b'zzz'
             )
@@ -1224,7 +1226,7 @@ def test_generated_extra_in_local_entry(self):
                 struct.pack('<HHQQ', 0x0001, 16, 0, 0) +
                 # unicode comment
                 struct.pack('<HHBL5s', 0x6375, 10, 1,
-                            zipfile.crc32(b'\u4e00'), b'\u4e00') +
+                            zipfile.crc32(comment), comment) +
                 # invalid tail
                 b'zzz'
             )