Create zipslip_bad.py

ahmed-farid-dev · web-flow · commit aef1df122bd5 · 2022-03-02T18:09:45.000+01:00
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py b/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py
@@ -0,0 +1,9 @@
+import zipfile
+import shutil
+
+
+zf = zipfile.ZipFile(filename)
+with zf.open() as zipf:
+    #BAD : This could write any file on the filesystem.
+    for entry in zipf:
+      shutil.copy(entry, "/tmp/unpack/")
