Skip to content

bpo-36260: Add pitfalls to zipfile module documentation #13378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaraco merged 4 commits into from
Sep 11, 2019
Merged

bpo-36260: Add pitfalls to zipfile module documentation #13378

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b73fe12
bpo-36260: Add pitfalls to zipfile module documentation
krnick May 17, 2019
e55fada
fix trailing whitespace
krnick Jun 1, 2019
2cdc370
📜🤖 Added by blurb_it.
blurb-it[bot] Jun 4, 2019
a28cc2a
Reformat text for consistency.
jaraco Sep 11, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
bpo-36260: Add pitfalls to zipfile module documentation 
We saw vulnerability warning description (including zip bomb) in Doc/library/xml.rst file.
This gave us the idea of documentation improvement. 

So, we moved a little bit forward :P
And the doc patch can be found (pr).
  • Loading branch information
@krnick
krnick authored May 17, 2019
commit b73fe12d4d85fc92e4b9658e417046b68fb68ecc
29 changes: 29 additions & 0 deletions Doc/library/zipfile.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -816,5 +816,34 @@ Command-line options

Test whether the zipfile is valid or not.

Decompression pitfalls
----------------------

The extraction in zipfile module might fail against some pitfalls listed below.

From file itself
Decompression may fail due to incorrect password / CRC checksum / ZIP format or
unsupported compression method / decryption.

File System limitations
Exceeding limitations on different file systems can cause decompression failed.
Such as allowable characters in the directory entries, length of the file name,
length of the pathname, size of a single file, and number of files, etc.

Resources limitations
The lack of memory or disk volume would lead to decompression
failed. For example, decompression bombs (aka `ZIP bomb`_)
apply to zipfile library that can cause disk volume exhaustion.

Interruption
Interruption during the decompression, such as pressing control-C or killing the
decompression process may result in incomplete decompression of the archive.

Default behaviors of extraction
Not knowing the default extraction behaviors
can cause unexpected decompression results.
For example, when extracting the same archive twice,
it overwrites files without asking.

.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
.. _PKZIP Application Note: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT