
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
zip_open
open file from nested zip file archive.
If you use static file like as 'data.zip' and open this from your
python code, Your program will become like
open(os.path.join(os.path.dirname(__file__), 'data.zip'))
.
But if your packages are packed into packages.zip file (zipped-egg,
or cases to gather in one file on Google App Engine matter), your
code doesn't work fine.
In this situation, the file path of data.zip becomes
/path/to/packages.zip/data.zip
, then your program can't open the
data.zip file.
zip_open
package solves this problem.
packages1.zip is::
packages1.zip + file1.txt
Open file1.txt::
from zip_open import zopen fobj = zopen('packages1.zip/file1.txt') data = fobj.read() print(data) I am file1.txt, ok.
You can specifiy zopen subpath args::
fobj = zopen('packages1.zip', 'file1.txt') print(fobj.read()) I am file1.txt, ok.
These code samples equivalent to below code::
from zipfile import ZipFile zipobj = ZipFile('packages1.zip') data = zipobj.read('file1.txt') print(data) I am file1.txt, ok.
packages2.zip is::
packages2.zip + data2.zip + file2.txt
Open file2.txt::
from zip_open import zopen fobj = zopen('packages2.zip/data2.zip/file2.txt') print(fobj.read()) I am file2.txt, ok.
If you want to open from file-like-object, you can call::
zip_fileobj = open('packages2.zip', 'rb') fobj = zopen(zip_fileobj, 'data2.zip/file2.txt') print(fobj.read()) I am file2.txt, ok.
then you also call::
from StringIO import StringIO zip_payload = open('packages2.zip', 'rb').read() zip_fileobj = StringIO(zip_payload) fobj = zopen(zip_fileobj, 'data2.zip/file2.txt') print(fobj.read()) I am file2.txt, ok.
packages3.zip is::
packages3.zip + foo.py + file1.txt + data3.zip + file3.txt
foo.py::
import os from zip_open import zopen
def loader(filename): fobj = zopen(os.path.join(os.path.dirname(file), filename)) return fobj
execute loader() from interactive shell::
import sys sys.path.insert(0, 'packages3.zip') import foo fobj = foo.loader('file1.txt') print(fobj.read()) I am file1.txt, ok. fobj = foo.loader('data3.zip/file3.txt') print(fobj.read()) I am file3.txt, ok.
0.2.1 (Unreleased)
* fixed: test broken (open file as binary)
* use distutils.core.setup if no setuptools.
0.2.0 (2011-11-29)
0.1.0 (2010-7-19)
* first release
FAQs
file open from nested zip file archive.
We found that zip_open demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.