Create zipslip_bad.py

2026-04-28 18:25:24 +02:00 · 2022-03-02 18:09:45 +01:00
parent c8f73ec845
commit aef1df122b
1 changed files with 9 additions and 0 deletions
--- a/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py
+++ b/python/ql/test/experimental/query-tests/Security/CWE-022/zipslip_bad.py
@@ -0,0 +1,9 @@
+import zipfile
+import shutil
+
+
+zf = zipfile.ZipFile(filename)
+with zf.open() as zipf:
+    #BAD : This could write any file on the filesystem.
+    for entry in zipf:
+      shutil.copy(entry, "/tmp/unpack/")