GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — GitHub - char/python_zip_null_patch: Bytecode patching for the Python 3.6 zipfile module to permit null bytes in paths

BranchesTags
Open more actions menu

Latest commit

 

History

3 Commits
3 Commits

Folders and files

NameName
Last commit message
Last commit date
.gitignore
.gitignore
 
 
README.md
README.md
 
 
zip_null_patch.py
zip_null_patch.py
 
 

Repository files navigation

zip_null_patch

A module to enable null characters in zipfile path names.

Motivation

In Python, the built-in zipfile module purposefully rejects paths containing null-byte characters. The reasoning is to prevent unintended behaviour from viruses which abuse null-byte paths in archives.

## CPython 3.6 -- zipfile.py

# Terminate the file name at the first null byte.  Null bytes in file
# names are used as tricks by viruses in archives.
null_byte = filename.find(chr(0))
if null_byte >= 0:
    filename = filename[0:null_byte]

However, if trying to purposefully read a zip created by a malicious program, Python provides no exit-hatch to forcefully enable the parsing of paths containing null-bytes. This means that proper analysis of any null-byte-containing archive is impossible.

Enter: zip_null_patch. Simply call zip_null_patch.patch_zipfile() and the built-in zipfile module will now accept null-bytes!

Usage

>>> import zipfile

>>> info = zipfile.ZipInfo(filename="abc\x00def")
>>> info.filename
'abc'

>>> import zip_null_patch
>>> zip_null_patch.patch_zipfile()

>>> info = zipfile.ZipInfo(filename="abc\x00def")
>>> info.filename
'abc\x00def'

About

Bytecode patching for the Python 3.6 zipfile module to permit null bytes in paths

Topics

patchingpythonpython-bytecodezip

Resources

Readme
Activity

Stars

3 stars

Watchers

1 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.