Update zipslip_good.py

ahmed-farid-dev · web-flow · commit 23bd53a325f5 · 2022-03-08T23:55:17.000+01:00
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_good.py b/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_good.py
@@ -1,4 +1,6 @@
 import zipfile 
+import tarfile
+import shutil
 
 def unzip(filename, dir):
   zf = zipfile.ZipFile(filename)
@@ -8,3 +10,11 @@ def unzip(filename, dir):
 def unzip1(filename, dir):
   zf = zipfile.ZipFile(filename)
   zf.extract(dir)
+  
+def unzip2(filename):
+  with tarfile.open(filename) as tar:
+    for entry in tar:
+        #GOOD: Check that entry is safe
+        if os.path.isabs(entry.name) or ".." in entry.name:
+            raise ValueError("Illegal tar archive entry")
+        shutil.copy(entry, "/tmp/unpack/")
