Zip bomb attack
Expanding input archive files without any validation could make your code vulnerable to zip bomb attacks, which could potentially cause denial of service (DoS). We recommend that you sanitize input archive files before extracting them.
@app.route('/someUrl')
def zip_bomb_attack_noncompliant():
    file = request.files['file']
    filename = file.filename
    file.save(filename)
    tfile = tarfile.open(filename)
    # Noncompliant: Untrusted archive file extracted without any validation.
    tfile.extractall('./tmp/')
    tfile.close()
@app.route('/someUrl')
def zip_bomb_attack_compliant():
    file = request.files['file']
    filename = file.filename
    file.save(filename)
    tfile = tarfile.open(filename)
    threshold_entries = 100  # some threshold value
    # Compliant: Untrusted archive file is validated before extraction.
    if len(tfile.getmembers()) < threshold_entries:
        tfile.extractall('./tmp/')
    tfile.close()