The tarfile module. extractall() and extract() follow archive entry paths as-is — path-traversal sink (zip slip) when the archive is user-supplied and extractall's filter= argument is not set to a safe filter. Python 3.12 changed the default to 'data'.
.extractall().extract().extractall()SinkTarFile.extractall(path='.', members=None, *, numeric_owner=False, filter=None) -> None
Extracts all entries. Zip-slip sink when members comes from a hostile archive and filter is unset.
.extract()SinkTarFile.extract(member, path='', *, set_attrs=True, numeric_owner=False, filter=None) -> None
Extracts a single entry. Same path-traversal risk as extractall.
.open()Neutraltarfile.open(name=None, mode='r', fileobj=None, ...) -> TarFile
Opens a tar archive. Neutral; extract() is where traversal happens.
| FQN | Field | |
|---|---|---|
| tarfile | fqns[0] | |
| tarfile.TarFile | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyTarfile