Safely extract zip or tar using Python
问题 I'm trying to extract user-submitted zip and tar files to a directory. The documentation for zipfile's extractall method (similarly with tarfile's extractall) states that it's possible for paths to be absolute or contain .. paths that go outside the destination path. Instead, I could use extract myself, like this: some_path = '/destination/path' some_zip = '/some/file.zip' zipf = zipfile.ZipFile(some_zip, mode='r') for subfile in zipf.namelist(): zipf.extract(subfile, some_path) Is this safe?