unzip-http 0.6__tar.gz → 0.8__tar.gz

{unzip-http-0.6/unzip_http.egg-info → unzip_http-0.8}/PKG-INFO

@@ -1,15 +1,17 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.6
+Version: 0.8
 Summary: extract files from .zip files over http without downloading entire archive
-Home-page: https://github.com/saulpw/unzip-http
 Author: Saul Pwanson
-Keywords: http zip unzip
-Classifier: Development Status :: 4 - Beta
+Project-URL: Homepage, https://github.com/saulpw/unzip-http
+Keywords: http,zip,unzip
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Programming Language :: Python :: 3
-Requires-Python: >=3.8
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE-mit.txt
+Requires-Dist: urllib3
+Dynamic: license-file
 
 # unzip-http
 
@@ -34,7 +36,7 @@ Note: HTTP server must send `Accept-Ranges: bytes` and `Content-Length` in heade
 Options:
 
 - `-l`: List files in remote .zip file (default if no filenames given)
-- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files to the current directly to the current directory)
+- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files directly to the current directory)
 - `-o`: Write files to stdout (if multiple files, concatenate them in zipfile order)
 
 # Python module `unzip_http`
@@ -48,3 +50,8 @@ Options:
 # Credits
 
 `unzip-http` was written by [Saul Pwanson](https://saul.pw) and made available for use under the MIT License.
+
+# Similar Libraries
+
+- [python-remotezip](https://github.com/gtsystem/python-remotezip)
+- [PyRemoteZip](https://github.com/fcvarela/pyremotezip)

{unzip-http-0.6 → unzip_http-0.8}/README.md

@@ -21,7 +21,7 @@ Note: HTTP server must send `Accept-Ranges: bytes` and `Content-Length` in heade
 Options:
 
 - `-l`: List files in remote .zip file (default if no filenames given)
-- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files to the current directly to the current directory)
+- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files directly to the current directory)
 - `-o`: Write files to stdout (if multiple files, concatenate them in zipfile order)
 
 # Python module `unzip_http`
@@ -35,3 +35,8 @@ Options:
 # Credits
 
 `unzip-http` was written by [Saul Pwanson](https://saul.pw) and made available for use under the MIT License.
+
+# Similar Libraries
+
+- [python-remotezip](https://github.com/gtsystem/python-remotezip)
+- [PyRemoteZip](https://github.com/fcvarela/pyremotezip)

unzip_http-0.8/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "unzip-http"
+version = "0.8"
+description = "extract files from .zip files over http without downloading entire archive"
+readme = "README.md"
+requires-python = ">=3.10"
+keywords = ["http", "zip", "unzip"]
+authors = [{name = "Saul Pwanson"}]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Programming Language :: Python :: 3",
+]
+dependencies = ["urllib3"]
+
+[project.urls]
+Homepage = "https://github.com/saulpw/unzip-http"
+
+[project.scripts]
+unzip_http = "unzip_http:main"
+
+[tool.setuptools]
+py-modules = ["unzip_http"]

unzip_http-0.8/tests/test_unzip_http.py

@@ -0,0 +1,37 @@
+import io
+import pathlib
+from types import SimpleNamespace
+
+import pytest
+
+import unzip_http
+
+
+def fake_rzf(contents):
+    rzf = unzip_http.RemoteZipFile.__new__(unzip_http.RemoteZipFile)
+    rzf.open = lambda fn: io.BytesIO(contents)
+    return rzf
+
+
+@pytest.mark.parametrize('member', ['../escaped.txt', '/tmp/absolute.txt', 'sub/../../escaped.txt'])
+def test_extract_refuses_escaping_member(tmp_path, member):
+    target = tmp_path/'target'
+    target.mkdir()
+    with pytest.raises(Exception, match='unsafe path'):
+        fake_rzf(b'x').extract(member, path=target)
+    assert list(tmp_path.rglob('*')) == [target]
+
+
+def test_extract_writes_inside_target(tmp_path):
+    fake_rzf(b'hello').extract('sub/ok.txt', path=tmp_path)
+    assert (tmp_path/'sub'/'ok.txt').read_bytes() == b'hello'
+
+
+def test_cli_full_filepaths_refuses_escaping_member(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(unzip_http, 'extract_one', lambda outfile, rzf, f, ofname: outfile.write(b'x'))
+    f = SimpleNamespace(filename='../escaped.txt', compress_size=1)
+    args = SimpleNamespace(files=['*'], stdout=False, full_filepaths=True)
+    with pytest.raises(Exception, match='unsafe path'):
+        unzip_http.download_file(f, None, args)
+    assert not (tmp_path.parent/'escaped.txt').exists()

{unzip-http-0.6 → unzip_http-0.8/unzip_http.egg-info}/PKG-INFO

@@ -1,15 +1,17 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: unzip-http
-Version: 0.6
+Version: 0.8
 Summary: extract files from .zip files over http without downloading entire archive
-Home-page: https://github.com/saulpw/unzip-http
 Author: Saul Pwanson
-Keywords: http zip unzip
-Classifier: Development Status :: 4 - Beta
+Project-URL: Homepage, https://github.com/saulpw/unzip-http
+Keywords: http,zip,unzip
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Programming Language :: Python :: 3
-Requires-Python: >=3.8
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE-mit.txt
+Requires-Dist: urllib3
+Dynamic: license-file
 
 # unzip-http
 
@@ -34,7 +36,7 @@ Note: HTTP server must send `Accept-Ranges: bytes` and `Content-Length` in heade
 Options:
 
 - `-l`: List files in remote .zip file (default if no filenames given)
-- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files to the current directly to the current directory)
+- `-f`: Recreate folder structure from .zip file when extracting (instead of extracting files directly to the current directory)
 - `-o`: Write files to stdout (if multiple files, concatenate them in zipfile order)
 
 # Python module `unzip_http`
@@ -48,3 +50,8 @@ Options:
 # Credits
 
 `unzip-http` was written by [Saul Pwanson](https://saul.pw) and made available for use under the MIT License.
+
+# Similar Libraries
+
+- [python-remotezip](https://github.com/gtsystem/python-remotezip)
+- [PyRemoteZip](https://github.com/fcvarela/pyremotezip)

{unzip-http-0.6 → unzip_http-0.8}/unzip_http.egg-info/SOURCES.txt

@@ -1,9 +1,9 @@
 LICENSE-mit.txt
 MANIFEST.in
 README.md
-requirements.txt
-setup.py
+pyproject.toml
 unzip_http.py
+tests/test_unzip_http.py
 unzip_http.egg-info/PKG-INFO
 unzip_http.egg-info/SOURCES.txt
 unzip_http.egg-info/dependency_links.txt

{unzip-http-0.6 → unzip_http-0.8}/unzip_http.py

@@ -56,7 +56,7 @@ import pathlib
 import urllib.parse
 
 
-__version__ = '0.6'
+__version__ = '0.8'
 
 
 def error(s):
@@ -117,6 +117,14 @@ class RemoteZipInfo:
             i += fieldsz
 
 
+def safe_extract_path(base, member):
+    base = pathlib.Path(base).resolve()
+    target = (base / member).resolve()
+    if base != target and base not in target.parents:
+        raise Exception(f'refusing unsafe path in zip member: {member!r}')
+    return target
+
+
 class RemoteZipFile:
     fmt_eocd = '<IHHHHIIH'  # end of central directory
     fmt_eocd64 = '<IQHHIIQQQQ'  # end of central directory ZIP64
@@ -151,11 +159,17 @@ class RemoteZipFile:
 
     def infoiter(self):
         resp = self.http.request('HEAD', self.url)
+        if not (200 <= resp.status <= 299):
+            error(f'cannot open URL: HTTP status {resp.status}')
+
         r = resp.headers.get('Accept-Ranges', '')
         if r != 'bytes':
             hostname = urllib.parse.urlparse(self.url).netloc
             warning(f"{hostname} Accept-Ranges header ('{r}') is not 'bytes'--trying anyway")
 
+        if 'Content-Length' not in resp.headers:
+            error('cannot open URL: missing Content-Length header')
+
         self.zip_size = int(resp.headers['Content-Length'])
         resp = self.get_range(
             max(self.zip_size-65536, 0),
@@ -217,10 +231,10 @@ class RemoteZipFile:
 
             path = path or pathlib.Path('.')
 
-            outpath = path/member
+            outpath = safe_extract_path(path, member)
             os.makedirs(outpath.parent, exist_ok=True)
             with self.open(member) as fpin:
-                with open(path/member, mode='wb') as fpout:
+                with open(outpath, mode='wb') as fpout:
                     while True:
                         r = fpin.read(65536)
                         if not r:
@@ -348,6 +362,7 @@ def download_file(f, rzf, args):
     else:
         path = pathlib.Path(f.filename)
         if args.full_filepaths:
+            path = safe_extract_path('.', path)
             path.parent.mkdir(parents=True, exist_ok=True)
         else:
             path = path.name

unzip-http-0.6/requirements.txt

@@ -1 +0,0 @@
-urllib3

unzip-http-0.6/setup.py

@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: MIT
-
-from setuptools import setup
-
-
-def readme():
-    with open("README.md") as f:
-        return f.read()
-
-def requirements():
-    with open("requirements.txt") as f:
-        return f.read().split("\n")
-
-
-setup(
-        name="unzip-http",
-        version="0.6",
-        description="extract files from .zip files over http without downloading entire archive",
-        long_description=readme(),
-        long_description_content_type="text/markdown",
-        classifiers=[
-            "Development Status :: 4 - Beta",
-            "Programming Language :: Python :: 3",
-        ],
-        keywords="http zip unzip",
-        author="Saul Pwanson",
-        url="https://github.com/saulpw/unzip-http",
-        python_requires=">=3.8",
-        py_modules=["unzip_http"],
-        scripts=["unzip_http.py"],
-        entry_points={
-            "console_scripts": ["unzip_http=unzip_http:main"],
-            },
-        install_requires=requirements(),
-)