bug: don't follow symlinks in archives (#1475)

.pre-commit-config.yaml

@@ -1,16 +1,16 @@
 repos:
 -   repo: https://github.com/pycqa/isort
-    rev: 5.9.3
+    rev: 5.10.1
     hooks:
     - id: isort
 
 -   repo: https://github.com/python/black
-    rev: 21.9b0
+    rev: 21.11b1
     hooks:
     - id: black
 
 -   repo: https://github.com/asottile/pyupgrade
-    rev: v2.29.0
+    rev: v2.29.1
     hooks:
     - id: pyupgrade
       args: ["--py36-plus"]

cve_bin_tool/extractor.py

@@ -61,6 +61,9 @@ def __init__(self, logger=None, error_mode=ErrorMode.TruncTrace):
 
     def can_extract(self, filename):
         """Check if the filename is something we know how to extract"""
+        # Do not try to extract symlinks
+        if os.path.islink(filename):
+            return False
         for extension in itertools.chain(*self.file_extractors.values()):
             if filename.endswith(extension):
                 return True

dev-requirements.txt

@@ -1,4 +1,4 @@
-black==21.9b0
-isort==5.9.3
-pre-commit==2.15.0
+black==21.11b1
+isort==5.10.1
+pre-commit==2.16.0
 flake8==4.0.1