diff --git a/bandit/plugins/tarfile_unsafe_members.py b/bandit/plugins/tarfile_unsafe_members.py index 499a66789..979feebdd 100644 --- a/bandit/plugins/tarfile_unsafe_members.py +++ b/bandit/plugins/tarfile_unsafe_members.py @@ -2,11 +2,12 @@ # SPDX-License-Identifier: Apache-2.0 # r""" -================================= -B202: Test for tarfile.extractall -================================= +============================================ +B202: Test for unsafe tarfile extraction +============================================ -This plugin will look for usage of ``tarfile.extractall()`` +This plugin will look for usage of ``tarfile.extractall()`` and +``tarfile.extract()`` Severity are set as follows: @@ -78,7 +79,7 @@ def exec_issue(level, members=""): severity=bandit.HIGH, confidence=bandit.HIGH, cwe=issue.Cwe.PATH_TRAVERSAL, - text="tarfile.extractall used without any validation. " + text="Unsafe tarfile extraction used without any validation. " "Please check and discard dangerous members.", ) @@ -107,12 +108,15 @@ def tarfile_unsafe_members(context): if all( [ context.is_module_imported_exact("tarfile"), - "extractall" in context.call_function_name, + context.call_function_name in ("extract", "extractall"), ] ): if "filter" in context.call_keywords and is_filter_data(context): return None - if "members" in context.call_keywords: + if ( + context.call_function_name == "extractall" + and "members" in context.call_keywords + ): members = get_members_value(context) if "Function" in members: return exec_issue(bandit.LOW, members) diff --git a/examples/tarfile_extractall.py b/examples/tarfile_extractall.py index b32736afb..a200b28c4 100644 --- a/examples/tarfile_extractall.py +++ b/examples/tarfile_extractall.py @@ -9,6 +9,13 @@ def unsafe_archive_handler(filename): tar.close() +def unsafe_extract_handler(filename): + tar = tarfile.open(filename) + for member in tar.getmembers(): + tar.extract(member, path=tempfile.mkdtemp()) + tar.close() + + def managed_members_archive_handler(filename): tar = tarfile.open(filename) tar.extractall(path=tempfile.mkdtemp(), members=members_filter(tar))