test.py

import tarfile
import zipfile
import tty # this import is only here so logic for detecting stdlib works
from fastapi import FastAPI

app = FastAPI()


@app.post("/bomb")
async def bomb(file_path):
    zipfile.ZipFile(file_path, "r").extract("file1")  # $ result=BAD
    zipfile.ZipFile(file_path, "r").extractall()  # $ result=BAD

    with zipfile.ZipFile(file_path) as myzip:
        with myzip.open('ZZ') as myfile:  # $ result=BAD
            a = myfile.readline()

    with zipfile.ZipFile(file_path) as myzip:
        with myzip.open('ZZ', mode="w") as myfile: # $ SPURIOUS: result=BAD
            myfile.write(b"tmpppp")

    zipfile.ZipFile(file_path).read("aFileNameInTheZipFile")  # $ result=BAD

    tarfile.open(file_path).extractfile("file1.txt")  # $ result=BAD
    tarfile.TarFile.open(file_path).extract("somefile")  # $ result=BAD
    tarfile.TarFile.xzopen(file_path).extract("somefile")  # $ result=BAD
    tarfile.TarFile.gzopen(file_path).extractall()  # $ result=BAD
    tarfile.TarFile.open(file_path).extractfile("file1.txt")  # $ result=BAD

    tarfile.open(file_path, mode="w") # ok, writing
    tarfile.TarFile.gzopen(file_path, mode="w") # ok, writing
    tarfile.TarFile.open(file_path, mode="r:") # potential problem, depending on usage
    import shutil

    shutil.unpack_archive(file_path)  # $ result=BAD

    import lzma

    lzma.open(file_path)  # $ result=BAD
    lzma.LZMAFile(file_path).read()  # $ result=BAD

    import bz2

    bz2.open(file_path)  # $ result=BAD
    bz2.BZ2File(file_path).read()  # $ result=BAD

    import gzip

    gzip.open(file_path)  # $ result=BAD
    gzip.GzipFile(file_path)  # $ result=BAD

    from compression import zstd

    zstd.open(file_path)  # $ result=BAD
    zstd.ZstdFile(file_path).read()  # $ result=BAD

    import pandas

    pandas.read_csv(filepath_or_buffer=file_path)  # $ result=BAD

    pandas.read_table(file_path, compression='gzip')  # $ result=BAD
    pandas.read_xml(file_path, compression='gzip')  # $ result=BAD

    pandas.read_csv(filepath_or_buffer=file_path, compression='gzip')  # $ result=BAD
    pandas.read_json(file_path, compression='gzip')  # $ result=BAD
    pandas.read_sas(file_path, compression='gzip')  # $ result=BAD
    pandas.read_stata(filepath_or_buffer=file_path, compression='gzip')  # $ result=BAD
    pandas.read_table(file_path, compression='gzip')  # $ result=BAD
    pandas.read_xml(path_or_buffer=file_path, compression='gzip')  # $ result=BAD

    # no compression no DOS
    pandas.read_table(file_path, compression='tar')
    pandas.read_xml(file_path, compression='tar')

    pandas.read_csv(filepath_or_buffer=file_path, compression='tar')
    pandas.read_json(file_path, compression='tar')
    pandas.read_sas(file_path, compression='tar')
    pandas.read_stata(filepath_or_buffer=file_path, compression='tar')
    pandas.read_table(file_path, compression='tar')
    pandas.read_xml(path_or_buffer=file_path, compression='tar')

    return {"message": "bomb"}