DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Overly restrictive tarball file extension checking #427

Closed ikretz closed 1 month ago

ikretz commented 1 month ago

GuardDog accepts .tar.gz and .tgz when checking whether or not a file is a tarball. This leaves out another valid extension for this same kind of compressed archive (.gz) as well as bzip2 and xz compressed archives that are also supported by the tarsafe package used for safe extraction.

We should add these other file extensions to be more compatible and reduce errors.