zippathlib 0.2.0

[ptmcg]

• Merged the --outputdir command line option into the --extract option

• Fixed extract code to always preserve internal ZIP directory hierarchy; fixed duplicate file write bug; raise error if trying to extract a directory to stdout

• Deleted name, stem, and suffix properties, inherit from PurePath class.

• Cleanup README and pyproject.toml omissions

---

This discussion was created from the release zippathlib 0.2.0.

[ptmcg]

Discusson on Discord, suggested adding guardrails for malicious ZIP files:

• extract outside the bounds of the extract directory (to overwrite files in /etc, for example - similar to issue with tarfile module)
• containing excessively large content files

Add file size limit (1GB? 5GB?) with command line override option.
Use an entry's ZipInfo to get file size instead of extracting and counting bytes.

[ptmcg]

More on Zip Bombs https://en.wikipedia.org/wiki/Zip_bomb

[ptmcg]

I added some guardrails to the CLI to limit extraction to 2GB, though there is a --limit option to override that if a larger file is needed, but it has to be a conscious decision by the user. The API does not have that guardrail, but it does have ZipPath.size() method to determine the size of a particular file, and total_size() method for the aggregate size of all files in a directory and its subdirectories.