fileaudit.targz_check module

fileaudit.targz_check module#

License MPL-2.0 (C) 2026 Created by Maikel Mardjan - https://nocomplexity.com/ FileAudit - TAR Security Checker

class fileaudit.targz_check.HTTPSOnlyRedirectHandler[source]#

Bases: HTTPRedirectHandler

Redirect handler that blocks any redirect to a non-HTTPS URL. Prevents downgrade attacks (e.g. https -> http redirects).

redirect_request(req, fp, code, msg, headers, newurl)[source]#

Return a Request or None in response to a redirect.

This is called by the http_error_30x methods when a redirection response is received. If a redirection should take place, return a new Request to allow http_error_30x to perform the redirect. Otherwise, raise HTTPError if no-one else should try to handle this url. Return None if you can’t but another Handler might.

exception fileaudit.targz_check.TarValidationError(message)[source]#

Bases: Exception

Custom exception for TAR validation failures in FileAudit.

fileaudit.targz_check.validate_tar_gz(func_or_path=None, max_file_size=None, max_uncompressed_ratio=None, max_tar_members=None, max_total_extracted_size=None, max_individual_file_size=None, max_filename_length=None, max_directory_depth=None)[source]#

Validate TAR.GZ files via decorator or direct invocation.

A TAR.GZ file validator that can operate in two modes:

  1. Decorator mode — wraps a function to validate a TAR.GZ file path passed as an argument before the function body runs.

  2. Direct call / CLI mode — validates a file immediately and returns a boolean result.

Security checks performed: - File size limits - GZip decompression ratio limits - Tar member count limits - Tar total extracted size limits - Tar individual file size limits - Tar path traversal protection - Reject symlinks/hardlinks/devices/FIFOs - Filename/path length limits - Directory depth limits

Usage:

@validate_tar_gz @validate_tar_gz() @validate_tar_gz(“custom_arg_name”, max_file_size=5000) validate_tar_gz(“path/to/file.tar.gz”, max_tar_members=100) # CLI usage

Parameters:

  • func_or_path (callable, str, pathlib.Path, or None) –

    • If a callable: the function to decorate (bare decorator usage: @validate_tar_gz).

    • If a str or Path: the file path to validate (direct call).

    • If a str that is a valid Python identifier: treated as the target argument name in decorator mode.

    • If None: returns a decorator factory.

  • max_file_size (int) – Maximum allowed compressed file size in bytes.

  • max_uncompressed_ratio (int) – Maximum GZip decompression ratio.

  • max_tar_members (int) – Maximum number of files/directories in TAR.

  • max_total_extracted_size (int) – Maximum total extracted size in bytes.

  • max_individual_file_size (int) – Maximum size per extracted file.

  • max_filename_length (int) – Maximum filename/path length.

  • max_directory_depth (int) – Maximum directory nesting depth.

Returns:

  • In decorator mode: the wrapped function.

  • In direct call mode: True if validation passes, False if it fails (errors are printed to stdout).

Return type:

Union[callable, bool, function]

Raises:

TarValidationError – If validation fails in decorator mode.