Zip Slip (ARCH2106)

Key python.security.zip-slip · Severity error · Category security · CWE CWE-22

Extracting archive entries without path validation lets entries containing ../ write files outside the target directory, enabling path traversal.

Incorrect

import zipfile

def extract(archive, dest):
    with zipfile.ZipFile(archive) as z:
        z.extractall(dest)

Correct

import os, zipfile

def extract(archive, dest):
    with zipfile.ZipFile(archive) as z:
        for name in z.namelist():
            target = os.path.realpath(os.path.join(dest, name))
            if not target.startswith(os.path.realpath(dest) + os.sep):
                raise ValueError("unsafe path: %s" % name)
            z.extract(name, dest)

Fix

Before extracting each entry, verify the resolved target path stays within the extraction root.