Hacker News Reader

Comment by masklinn | Hacker News Reader

https://docs.python.org/3/library/zipfile.html?highlight=zip...

> If a member filename is an absolute path, a drive/UNC sharepoint and leading (back)slashes will be stripped, e.g.: ///foo/bar becomes foo/bar on Unix, and C:\foo\bar becomes foo\bar on Windows. And all ".." components in a member filename will be removed, e.g.: ../../foo../../ba..r becomes foo../ba..r. On Windows illegal characters (:, <, >, |, ", ?, and *) replaced by underscore (_).

Sure reads like directory traversal mitigation.

View on HN

It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal.

While by itself this might be a deliberate design choice, it vows for an easy mistake.

I'm a fan of telling that a function is unsafe (by design) by its name. So `unsafeExtractall` or something like it. That should give a clear warning to investigate unless you know what you're doing.

`extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths.

See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py

Good catch. Seems like the docs warn too much on this then, but good to see that it's not a problem in Python.

The warning says that it attempts to mitigate it (with a referral to the documentation of the extract function). It's of course a bit strange that in one case it's a note that explains how the mitigation works, and in the other case it's a warning to not blindly trust foreign zips, but it seems clear to me that either both are affected, or neither of them is.

Documentation, the other "hard" task in CS.

> It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal.

You're misreading the warning. It's saying that the module attempts to mitigate the issue (referring back to ZipFile.extract) but pointing out that this may not be entirely reliable, and thus that as the library user you really should inspect/validate archive paths before doing an on-disk extraction.

I stand corrected. I was mislead by the scary warning, which is still there.

The tarfile module is still vulnerable:

https://bugs.python.org/issue17102

Reply on news.ycombinator.com