Skip to content

Commit a50f051

Browse files
Update zipslip_bad.py
1 parent cafbd98 commit a50f051

File tree

1 file changed

+6
-6
lines changed
  • python/ql/test/experimental/query-tests/Security/CWE-022

1 file changed

+6
-6
lines changed

python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@ def unzip2(filename):
2424

2525
def unzip3(filename):
2626
zf = zipfile.ZipFile(filename)
27-
filelist = zf.namelist()
27+
with zf.namelist() as filelist:
2828
#BAD : This could write any file on the filesystem.
29-
for filename in filelist:
30-
shutil.copy(entry, "/tmp/unpack/")
29+
for x in filelist:
30+
shutil.copy(x, "/tmp/unpack/")
3131

3232
def unzip4(filename):
3333
zf = zipfile.ZipFile(filename)
3434
filelist = zf.namelist()
35-
for filename in filelist:
36-
with zf.open(filename) as srcf:
37-
shutil.copyfileobj(srcf, dstfile)
35+
for x in filelist:
36+
with zf.open(x) as srcf:
37+
shutil.copyfileobj(x, dstfile)
3838

0 commit comments

Comments
 (0)