Author schmir
Recipients schmir
Date 2009-09-22.22:10:49
SpamBayes Score 6.67082e-05
Marked as misclassified No
Message-id <>
ZipFile.extractall happily overwrites any file on the filesystem. One
can put files with a name like "//etc/password" in a zip file and
extractall will overwrite /etc/password (with sufficient rights).

The docs say:

ZipFile.extractall([path[, members[, pwd]]])

    Extract all members from the archive to the current working
directory. path specifies a different directory to extract to. members
is optional and must be a subset of the list returned by namelist(). pwd
is the password used for encrypted files.

I read that as: it will put all files into path or a subdirectory.
Using names like "../../../etc/password" also leads to files being
written outside that path directory.
Date User Action Args
2009-09-22 22:10:52schmirsetrecipients: + schmir
2009-09-22 22:10:52schmirsetmessageid: <>
2009-09-22 22:10:50schmirlinkissue6972 messages
2009-09-22 22:10:49schmircreate