python zip文件模块是否自动修改安全?

时间:2015-04-16 18:13:05

标签: python zip zipfile

将文件附加到运行python zip文件模块本身是否安全?

我写了__main__.py如下。

import sys, zipfile
w = zipfile.ZipFile(sys.argv[0], "w") # opening script self for writing.
w.write("newfile")                    # appending "newfile" to script self.
w.close()

r = zipfile.ZipFile(sys.argv[0], "r") # opening script self for reading.
print(r.open("newfile").read())       # print "newfile" content.
r.close()

,执行如下。

$ ls
__main__.py
$ zip -r test.zip *    <<<=== creating python zip file module.
    adding: __main__.py (deflated 35%)
$ echo "ABC" > newfile <<<=== creating a new file to be added to "test.zip"
$ ls
__main__.py  newfile  test.zip
$ python test.zip      <<<=== running "test.zip" python zip file module.
b'ABC\n'               <<<=== printed out "newfile" content.

从这个结果来看,它看起来运作良好。但是,我无法确认这种自我修改方法和行为结果是否符合python规范。

0 个答案:

没有答案