zipfile's extractall method with a path check that the target folder is the prefix after utilizing os.path.normpath

zipfile_extractall_secure.py

import os.path
import zipfile

# tested with python 3.8.10

def secure_zipfile_extractall(zip_filedesc, target_directory):
    """Copy all files recorded in zipfile `zip_filedesc`
    to the directory `target_directory`, but prevent malicious filepaths
    like `../../../etc/hosts` by using os.path.normpath
    """
    if not target_directory.endswith('/'):
        target_directory = target_directory + '/'

    def is_secure(member_path):
        if member_path.startswith('/') or member_path.startswith('\\'):
            return False
        if '//' in member_path or '\\\\' in member_path:
            return False
        target_path = os.path.join(target_directory, member_path)
        return os.path.normpath(target_path).startswith(target_directory)

    zip_filepaths = filter(is_secure, zip_filedesc.namelist())
    for filepath in zip_filepaths:
        zip_filedesc.extract(filepath, path=target_directory)

# Example:
with zipfile.ZipFile("archive.zip", 'r') as zfd:
    ## insecure way:
    #zfd.extractall(path=tmp_folder)

    # secure way:
    secure_zipfile_extractall(zfd, tmp_folder)