larzarchive

zip/tar with safe extraction. Pure Python, zero dependencies.

Extracting an untrusted archive is a classic vulnerability: a member named ../../etc/cron.d/x or an absolute path escapes the destination ("Zip Slip"). larzarchive refuses those by resolving every member's real path and checking it stays inside the target - and it skips symlink/device members in tars. A clean create/extract/list API over the standard library, auto-detecting format.

from larzarchive import create, extract, listing

create("bundle.zip", "myfolder")
create("bundle.tar.gz", ["a.txt", "b.txt"])
extract("bundle.zip", "out/")        # raises UnsafeArchive on a malicious member
listing("bundle.zip")

Why

• Safe by default. extract() validates every member's resolved path against the destination, so path-traversal ("Zip Slip") archives raise UnsafeArchive instead of overwriting files outside the target. It also skips symlink/hardlink/ device entries in tars. (safe=False is a documented escape hatch.)
• One API, every format. zip, tar, tar.gz, tar.bz2, tar.xz - detected from the filename. create takes a directory, a single file, or a list of paths (or (path, arcname) pairs).
• Zero dependencies. A thin, hardened layer over zipfile/tarfile.

Install

pip install larzarchive

Usage

from larzarchive import create, extract, listing

create("release.tar.gz", "dist")               # a directory
create("files.zip", ["a.txt", "b.txt"])         # a list of files
listing("release.tar.gz")                       # -> member names
paths = extract("release.tar.gz", "unpacked/")  # safe; returns extracted paths

Tests

python -m unittest discover -s tests -v   # 7 tests incl. zip-slip + tar-slip rejection

The Larz stack

One of 30+ pure-Python, zero-dependency libraries at github.com/larz-scripter.

License

MIT (c) larz-scripter