[GH] Limit archive member count to prevent zip bomb attacks (tooling-trusted-releases)

["sbp (via GitHub)" <gi...@apache.org>]

sbp commented on code in PR #605:
URL: https://github.com/apache/tooling-trusted-releases/pull/605#discussion_r2737141970


##########
atr/tarzip.py:
##########
@@ -125,6 +145,34 @@ def extractfile(self, member_wrapper: Member) -> IO[bytes] | None:
         except (KeyError, AttributeError, Exception):
             return None
 
+    def extract_member(
+        self,
+        member_wrapper: Member,
+        path: str,
+        *,
+        numeric_owner: bool = True,
+        tar_filter: Literal["fully_trusted", "tar", "data"] | None = "fully_trusted",
+    ) -> None:
+        """Extract a single member to the specified path.
+
+        For tar archives, this uses the tarfile extract method with the specified filter.
+        For zip archives, this is a no-op as zip extraction is handled differently
+        (directories are created via os.makedirs in the calling code).
+        """
+        match self._archive_obj:
+            case tarfile.TarFile() as tf:
+                if not isinstance(member_wrapper, TarMember):
+                    raise TypeError("Archive is TarFile, but member_wrapper is not TarMember")
+                tf.extract(
+                    member_wrapper._original_info,
+                    path,
+                    numeric_owner=numeric_owner,
+                    filter=tar_filter,
+                )
+            case zipfile.ZipFile():
+                # Zip extraction is handled differently in the calling code

Review Comment:
   I suppose we should either handle this the same in the caller, or raise a `NotImplementedError` here.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org