https://nalar.dev/tags/file-handling/ Recent content in File Handling on Nalar Hugo en-us Tue, 08 Sep 2026 00:00:00 +0700 https://nalar.dev/inspect-zip-archives-before-extraction-in-python/ Tue, 08 Sep 2026 00:00:00 +0700 https://nalar.dev/inspect-zip-archives-before-extraction-in-python/ <p>ZIP extraction looks like a single filesystem operation, but an archive is really a collection of filenames, metadata, and compressed byte streams supplied by whoever created the file. When the archive is untrusted, that metadata belongs at a trust boundary.</p> <p>Python&rsquo;s <code>zipfile</code> module provides convenient extraction helpers, and those helpers include protections for suspicious path components. The documentation still warns against extracting untrusted archives without prior inspection. That distinction is useful: library normalization is not the same thing as an application-specific acceptance policy.</p>