5 ms·

It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate direct

It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal. While by itself this might be a deliberate design choice, it vows for an easy mistake. I'm a fan of telling that a function is unsafe (by design) by its name. So `unsafeExtractall` or something like it. That should give a clear warning to investigate unless you know what you're doing.

ishi 8y ago
`extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths. See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py https://github.com/python/cpython/blob/3.6/Lib/zipfile.py
- bjpbakker 8y ago
  Good catch. Seems like the docs warn too much on this then, but good to see that it's not a problem in Python.
  - deleted 8y ago
    [deleted]
irishsultan 8y ago
The warning says that it attempts to mitigate it (with a referral to the documentation of the extract function). It's of course a bit strange that in one case it's a note that explains how the mitigation works, and in the other case it's a warning to not blindly trust foreign zips, but it seems clear to me that either both are affected, or neither of them is.
- wstuartcl 8y ago
  Documentation, the other "hard" task in CS.
masklinn 8y ago
> It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal. You're misreading the warning. It's saying that the module attempts to mitigate the issue (referring back to ZipFile.extract) but pointing out that this may not be entirely reliable, and thus that as the library user you really should inspect/validate archive paths before doing an on-disk extraction.

ishi 8y ago

`extractall` does mitigate directory traversal. Looking at the source code, both `extract` and `extractall` call `_extract_member` which sanitizes the file paths. See https://github.com/python/cpython/blob/3.6/Lib/zipfile.py https://github.com/python/cpython/blob/3.6/Lib/zipfile.py

bjpbakker 8y ago
Good catch. Seems like the docs warn too much on this then, but good to see that it's not a problem in Python.
- deleted 8y ago
  [deleted]

irishsultan 8y ago

The warning says that it attempts to mitigate it (with a referral to the documentation of the extract function). It's of course a bit strange that in one case it's a note that explains how the mitigation works, and in the other case it's a warning to not blindly trust foreign zips, but it seems clear to me that either both are affected, or neither of them is.

wstuartcl 8y ago
Documentation, the other "hard" task in CS.

masklinn 8y ago

> It does. However, in your linked document just below the `extract` function there is `extractall` that actually has a warning that it does /not/ mitigate directory traversal. You're misreading the warning. It's saying that the module attempts to mitigate the issue (referring back to ZipFile.extract) but pointing out that this may not be entirely reliable, and thus that as the library user you really should inspect/validate archive paths before doing an on-disk extraction.