Unhandled exception / crash (`zipfile.BadZipFile`) on non-zip input in `python/extract_har.py`

[PierrePrevostAvenel]

Description

In python/extract_har.py, opening the input file with zipfile.ZipFile(harzip) is done without a try/except block catching zipfile.BadZipFile. If a user provides an invalid, corrupted, or non-ZIP file (e.g. a plain .txt file, a raw .har file, or truncated data), the script crashes abruptly with an unhandled zipfile.BadZipFile traceback rather than providing a user-friendly error message or exiting gracefully.

Vulnerable Code Location

In python/extract_har.py (lines 73-83):

with zipfile.ZipFile(harzip) as zf:
    # Read the HAR JSON file
    try:
        har_content = json.loads(zf.read("har.har"))
    except KeyError:
        click.echo("Error: har.har not found in archive", err=True)
        return
    except json.JSONDecodeError:
        click.echo("Error: Invalid JSON in har.har", err=True)
        return

While KeyError and json.JSONDecodeError are handled inside the block, zipfile.ZipFile(...) itself is not wrapped in exception handling for zipfile.BadZipFile.

Impact

• Severity: Medium
• Vulnerability Type: Improper Error Handling / Denial of Service (CWE-754 / CWE-248)
• Any invalid input causes an unhandled exception and crash with stack trace, breaking automated batch pipelines or tooling that integrates this script.

Steps to Reproduce (PoC)

1. Create a non-ZIP file:

echo "not a zip file" > invalid.txt

2. Run extract_har.py with this file:

python3 python/extract_har.py invalid.txt text/plain

3. Traceback observed:

Traceback (most recent call last):
  ...
  File ".../zipfile/__init__.py", line 1334, in _RealGetContents
    raise BadZipFile("File is not a zip file")
zipfile.BadZipFile: File is not a zip file

Suggested Fix

Wrap zipfile.ZipFile(harzip) in a try/except zipfile.BadZipFile block and report a clear error using click.echo(..., err=True):

try:
    with zipfile.ZipFile(harzip) as zf:
        # Read the HAR JSON file
        try:
            har_content = json.loads(zf.read("har.har"))
        except KeyError:
            click.echo("Error: har.har not found in archive", err=True)
            return
        except json.JSONDecodeError:
            click.echo("Error: Invalid JSON in har.har", err=True)
            return
        ...
except zipfile.BadZipFile:
    click.echo(f"Error: {harzip} is not a valid zip file", err=True)
    return