Build a safe ZIP allowlist for a downloadable product

By Batu · English technical notes

Also published in our Blogger archive.

Write the exact reviewed ZIP members

writestr creates the named archive member directly. Reopening the finished ZIP and comparing namelist checks the central-directory result, not just the code’s intended write. Since the script does not walk a directory, adjacent temporary files cannot be included by accident.

This is a name allowlist, not a content review: README.txt can still contain unexpected bytes, and duplicate member names or compression choices remain separate rules. The explicit member name is what the archive records.

Example

from pathlib import Path
from tempfile import TemporaryDirectory
with TemporaryDirectory() as d:
    from zipfile import ZipFile
    z = Path(d) / 'r.zip'
    with ZipFile(z, 'w') as f:
        f.writestr('README.txt', 'ok')
    with ZipFile(z) as f:
        assert f.namelist() == ['README.txt']
    result = 'entries=README.txt'
    print(result)

Expected stdout:

entries=README.txt

Sources

- zipfile.ZipFile.writestr

- zipfile.ZipFile.namelist

Prepared with AI assistance. The example uses synthetic data; its stated limits apply.