We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent cafbd98 commit a50f051Copy full SHA for a50f051
python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py
@@ -24,15 +24,15 @@ def unzip2(filename):
24
25
def unzip3(filename):
26
zf = zipfile.ZipFile(filename)
27
- filelist = zf.namelist()
+ with zf.namelist() as filelist:
28
#BAD : This could write any file on the filesystem.
29
- for filename in filelist:
30
- shutil.copy(entry, "/tmp/unpack/")
+ for x in filelist:
+ shutil.copy(x, "/tmp/unpack/")
31
32
def unzip4(filename):
33
34
filelist = zf.namelist()
35
36
- with zf.open(filename) as srcf:
37
- shutil.copyfileobj(srcf, dstfile)
+ with zf.open(x) as srcf:
+ shutil.copyfileobj(x, dstfile)
38
0 commit comments