The shutil module for high-level file operations. unpack_archive automatically extracts tar / zip / gztar / bztar / xztar archives — same zip-slip risks as tarfile.extractall. copytree can also be used for path-traversal.
.unpack_archive().copyfile().copytree().rmtree().unpack_archive()Sinkshutil.unpack_archive(filename, extract_dir=None, format=None) -> None
Unpacks an archive. Zip-slip sink on untrusted archives — uses tarfile / zipfile under the hood.
.copyfile()Sinkshutil.copyfile(src, dst, *, follow_symlinks=True) -> str
Copies a file. Path-traversal sink when src / dst is user-controlled.
0, 1.copytree()Sinkshutil.copytree(src, dst, symlinks=False, ...) -> str
Recursively copies a directory. Path-traversal sink on untrusted paths.
0, 1.rmtree()Sinkshutil.rmtree(path, ignore_errors=False, onerror=None) -> None
Recursively deletes a directory tree. Finding on user-controlled path (arbitrary-file-delete).
0.which()Neutralshutil.which(cmd, mode=os.F_OK | os.X_OK, path=None) -> str | None
Locates an executable on PATH. Neutral.
| FQN | Field | |
|---|---|---|
| shutil | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyShutil