wpt.fyi
                                
                                 wpt.fyi copied to clipboard
                                
                                    wpt.fyi copied to clipboard
                            
                            
                            
                        [results-processor] will overwrite files when extracting from a ZIP
In the following:
https://github.com/web-platform-tests/wpt.fyi/blob/d6339c43adc80e4d5daaf3b27b521c166a15c9b8/results-processor/processor.py#L200-L210
There's nothing stopping us from overwriting files that already exist when extracting, and it's hard to check for in advance given ZipFile.extract does some normalization of the path.
This would be bad if someone uploaded archive1.zip and archive2.zip, both containing wptreport.json and wptscreenshot.txt, which feels like a totally sensible thing to do.
We should probably just create a new temporary directory within self._temp_dir (via tempdir.mkdtemp(dir=self._temp_dir) for each archive file we're processing, and extract into that. This still isn't totally safe, but for there to be any risk you really need someone trying to be malicious.