Python: Add modelling for zstd.compression

python/ql/lib/change-notes/2025-12-09-add-modelling-of-zstd-compression.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `compression.zstd` library (added in Python 3.14) is now supported by the `py/decompression-bomb` query.

python/ql/src/experimental/semmle/python/security/DecompressionBomb.qll

@@ -364,6 +364,46 @@ module Lzma {
   }
 }
 
+/** Provides sinks and additional taint steps related to the `zstd` library in Python 3.14+. */
+module Zstd {
+  private API::Node zstdInstance() {
+    result = API::moduleImport("compression").getMember("zstd").getMember(["ZstdFile", "open"])
+  }
+
+  /**
+   * The Decompression Sinks of `zstd` library
+   *
+   * `zstd.open(sink)`
+   * `zstd.ZstdFile(sink)`
+   *
+   * only read mode is sink
+   */
+  class DecompressionSink extends DecompressionBomb::Sink {
+    DecompressionSink() {
+      exists(API::CallNode zstdCall | zstdCall = zstdInstance().getACall() |
+        this = zstdCall.getParameter(0, "filename").asSink() and
+        (
+          not exists(
+            zstdCall
+                .getParameter(1, "mode")
+                .getAValueReachingSink()
+                .asExpr()
+                .(StringLiteral)
+                .getText()
+          ) or
+          zstdCall
+              .getParameter(1, "mode")
+              .getAValueReachingSink()
+              .asExpr()
+              .(StringLiteral)
+              .getText()
+              .matches("%r%")
+        )
+      )
+    }
+  }
+}
+
 /**
  * `io.TextIOWrapper(ip, encoding='utf-8')` like following:
  * ```python