Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

B202: tarfile_unsafe_members #30

Open
tduigou opened this issue May 17, 2023 · 0 comments
Open

B202: tarfile_unsafe_members #30

tduigou opened this issue May 17, 2023 · 0 comments

Comments

@tduigou
Copy link
Member

tduigou commented May 17, 2023

We need to fix this safety error detected by bandit (check CI workflow):

=== BANDIT REPORT ===
Run started:2023-05-17 14:44:40.852460

Test results:
>> Issue: [B202:tarfile_unsafe_members] tarfile.extractall used without any validation. Please check and discard dangerous members.
   Severity: High   Confidence: High
   CWE: CWE-22 (https://cwe.mitre.org/data/definitions/22.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b202_tarfile_unsafe_members.html
   Location: ../../rptools/rpreport/rp_report.py:250:16
249	                tar = tarfile.open(source_path, mode='r')
250	                tar.extractall(path=tmp_folder)
251	                tar.close()

--------------------------------------------------
>> Issue: [B202:tarfile_unsafe_members] tarfile.extractall used without any validation. Please check and discard dangerous members.
   Severity: High   Confidence: High
   CWE: CWE-22 (https://cwe.mitre.org/data/definitions/22.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b202_tarfile_unsafe_members.html
   Location: ../../rptools/rpviz/__main__.py:72:20
71	                with tarfile.open(args.input_rpSBMLs, mode='r') as tar:
72	                    tar.extractall(path=tmp_folder)
73	                _ = list(Path(tmp_folder).glob('*.xml'))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant