Hacker News Reader

`extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths.

See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py

Good catch. Seems like the docs warn too much on this then, but good to see that it's not a problem in Python.

> It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal.

You're misreading the warning. It's saying that the module attempts to mitigate the issue (referring back to ZipFile.extract) but pointing out that this may not be entirely reliable, and thus that as the library user you really should inspect/validate archive paths before doing an on-disk extraction.

The warning says that it attempts to mitigate it (with a referral to the documentation of the extract function). It's of course a bit strange that in one case it's a note that explains how the mitigation works, and in the other case it's a warning to not blindly trust foreign zips, but it seems clear to me that either both are affected, or neither of them is.

Documentation, the other "hard" task in CS.