cpython commands

ReviewToolkits/cpython-security-toolkit

Command

Archive extraction boundary analysis. Checks whether CPython's tarfile, zipfile, and shutil.unpackarchive implementations correctly enforce the invariant that no extraction path may write outside the declared destination directory.

ReviewToolkits/cpython-security-toolkit

Command

Protocol validation coverage analysis. Checks whether security-sensitive values in CPython's HTTP, cookie, WSGI, and URL handling modules are validated consistently across all code paths — including update methods, operator overloads, unpickling, and template substitution paths.

ReviewToolkits/cpython-security-toolkit

Command

Full security scan of a CPython source tree using all four engines.