False negative: unzip using subprocess or `shutil.unpack_archive` is not covered in py/tarslip

Open

#21,712 opened on Apr 15, 2026 0 comments 1 reaction 2 assignees View on GitHub

@hvitved is already working on this.

Since Apr 16, 2026.

#21720 by @copilot-swe-agent — open

Assessment

This issue has not been assessed yet.

Description

The rule currently misses standard library functions and patterns that perform archive extraction, such as shutil.unpack_archive and system tar commands invoked via subprocess.

https://github.com/positive666/yolo_research/blob/f5795f27a56ca4dbe4c182e12f61309a52e23967/utils/downloads.py#L173
https://github.com/JohnClema/xffl/blob/a920300239a82a85a87d0bf25735762844ee8e9d/aggregator/aggregation.py#L9

Here is a minimal, simplified code example to reproduce:

 import tarfile, sys, shutil, zipfile, subprocess
 unsafe_filename = sys.argv[1]
 tar = tarfile.open(unsafe_filename) 
 tar.extractall() # detected
 # 1. shutil 
 shutil.unpack_archive(unsafe_filename, "out") # not detected
 # 2. subprocess
 subprocess.run(["tar", "-xf", unsafe_filename]) # not detected

Dominant language: CodeQL
Stars: 10.1k
Forks: 2.1k
Avg merge: 2d 10h
Merged PRs (30d): 134

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

False negative: unzip using subprocess or `shutil.unpack_archive` is not covered in py/tarslip

Assessment

Description

Contributor guide

First steps

More from github/codeql

Get new issues in your inbox