Skip to content

Files

Latest commit

 

History

History
17 lines (10 loc) · 706 Bytes

B202.md

File metadata and controls

17 lines (10 loc) · 706 Bytes

Pattern: Use of tarfile.extractall()

Issue: -

Description

Severity are set as follows:

`tarfile.extractalll(members=function(tarfile))` - LOW
`tarfile.extractalll(members=?)` - member is not a function - MEDIUM
`tarfile.extractall()` - members from the archive is trusted - HIGH

Use tarfile.extractall(members=function_name) and define a function that will inspect each member. Discard files that contain a directory traversal sequences such as ../ or .. along with all special filetypes unless you explicitly need them.

Further Reading