diff --git a/lib/utils.py b/lib/utils.py index fffe129..eb2649f 100644 --- a/lib/utils.py +++ b/lib/utils.py @@ -313,9 +313,9 @@ def extract_zip_contents( io.BytesIO(file_bytes) if isinstance(file_bytes, bytes) else file_bytes ) with zipfile.ZipFile(stream) as zf: - for name in zf.namelist(): - with zf.open(name) as f: - yield name, f + for info in zf.infolist(): + with zf.open(info) as f: + yield info.filename, f def is_bz2_bytes(file_bytes: bytes | BinaryIO) -> bool: diff --git a/saferpickle.py b/saferpickle.py index ef29938..94189be 100644 --- a/saferpickle.py +++ b/saferpickle.py @@ -1087,7 +1087,8 @@ def _extract_and_scan_archive( if archive_type == "zip": try: with zipfile.ZipFile(io.BytesIO(data)) as zf: - for name in zf.namelist(): + for info in zf.infolist(): + name = info.filename if ".." in name or name.startswith("/"): # Zip slip detection logging.warning("Zip slip detected: %s", name) @@ -1097,7 +1098,7 @@ def _extract_and_scan_archive( "unknown": 0, } # Return early - with zf.open(name) as f: + with zf.open(info) as f: content = f.read() scores = security_scan( content,