How are parent directories in archives handled?

[wolph]

It's a common security issue with many archive packages that if the path within the archive is specified as ../../../something.txt you can accidently overwrite files outside of your working directory.

Does this library protect against that? If not, how can I manually specify where to write the output?

With the zipfile library I generally solve it like this:

import os


def sanitize_path(path):
    return os.path.normpath('/' + path).lstrip('/')


target_directory = 'something/'

with zipfile.ZipFile(zip_filename, 'r') as zip_fh:
    for name in zip_fh.namelist():
        clean_name = sanitize_path(name)
        extract_to = os.path.join(target_directory, clean_name)

        zip_.extract(
            name,
            extract_to,
        )