Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(Reworked) Add ability to limit output size for zip archives (against zip bombs) #117

Closed
wants to merge 3 commits into from
Closed

(Reworked) Add ability to limit output size for zip archives (against zip bombs) #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62a5af1
Remove redundant call to 'extractFileIfIncluded'.
Aug 23, 2019
40f072b
Remove code duplication.
Aug 23, 2019
bb22cd4
Add ability to limit output size for zip unarchiver as a way of prote…
Aug 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
73 changes: 35 additions & 38 deletions src/main/java/org/codehaus/plexus/archiver/zip/AbstractZipUnArchiver.java
View file
Open in desktop
Expand Up @@ -29,7 +29,8 @@
import org.apache.commons.compress.archivers.zip.ZipFile;
import org.codehaus.plexus.archiver.AbstractUnArchiver;
import org.codehaus.plexus.archiver.ArchiverException;
import org.codehaus.plexus.components.io.filemappers.FileMapper;
import org.apache.commons.io.input.BoundedInputStream;
import org.apache.commons.io.input.CountingInputStream;
import org.codehaus.plexus.components.io.resources.PlexusIoResource;

/**
Expand All @@ -43,6 +44,8 @@ public abstract class AbstractZipUnArchiver

private String encoding = "UTF8";

private long maxOutputSize = Long.MAX_VALUE;

public AbstractZipUnArchiver()
{
}
Expand All @@ -67,6 +70,21 @@ public void setEncoding( String encoding )
this.encoding = encoding;
}

/**
* Set maximum allowed size of the produced output.
*
* It may be used as a protection against <a href="https://en.wikipedia.org/wiki/Zip_bomb">zip bombs</a>.
*
* @param maxOutputSize max size of the produced output, in bytes. Must be greater than 0
* @throws IllegalArgumentException if specified output size is less or equal to 0
*/
public void setMaxOutputSize( long maxOutputSize ) {
if ( maxOutputSize <= 0 ) {
throw new IllegalArgumentException( "Invalid max output size specified: " + maxOutputSize );
}
this.maxOutputSize = maxOutputSize;
}

private static class ZipEntryFileInfo
implements PlexusIoResource
{
Expand Down Expand Up @@ -159,31 +177,7 @@ public boolean isExisting()
protected void execute()
throws ArchiverException
{
getLogger().debug( "Expanding: " + getSourceFile() + " into " + getDestDirectory() );
try ( ZipFile zf = new ZipFile( getSourceFile(), encoding, true ) )
{
final Enumeration<ZipArchiveEntry> e = zf.getEntriesInPhysicalOrder();
while ( e.hasMoreElements() )
{
final ZipArchiveEntry ze = e.nextElement();
final ZipEntryFileInfo fileInfo = new ZipEntryFileInfo( zf, ze );
if ( isSelected( fileInfo.getName(), fileInfo ) )
{
try ( InputStream in = zf.getInputStream( ze ) )
{
extractFileIfIncluded( getSourceFile(), getDestDirectory(), in, fileInfo.getName(),
new Date( ze.getTime() ), ze.isDirectory(),
ze.getUnixMode() != 0 ? ze.getUnixMode() : null,
resolveSymlink( zf, ze ), getFileMappers() );
}
}
}
getLogger().debug( "expand complete" );
}
catch ( final IOException ioe )
{
throw new ArchiverException( "Error while expanding " + getSourceFile().getAbsolutePath(), ioe );
}
execute("", getDestDirectory());
}

private String resolveSymlink( ZipFile zf, ZipArchiveEntry ze )
Expand All @@ -199,20 +193,14 @@ private String resolveSymlink( ZipFile zf, ZipArchiveEntry ze )
}
}

private void extractFileIfIncluded( final File sourceFile, final File destDirectory, final InputStream inputStream,
final String name, final Date time, final boolean isDirectory,
final Integer mode, String symlinkDestination, final FileMapper[] fileMappers )
throws IOException, ArchiverException
{
extractFile( sourceFile, destDirectory, inputStream, name, time, isDirectory, mode, symlinkDestination, fileMappers );
}

@Override
protected void execute( final String path, final File outputDirectory )
throws ArchiverException
{
getLogger().debug( "Expanding: " + getSourceFile() + " into " + outputDirectory );
try ( ZipFile zipFile = new ZipFile( getSourceFile(), encoding, true ) )
{
long remainingSpace = maxOutputSize;
final Enumeration<ZipArchiveEntry> e = zipFile.getEntriesInPhysicalOrder();

while ( e.hasMoreElements() )
Expand All @@ -228,13 +216,22 @@ protected void execute( final String path, final File outputDirectory )
{
try ( InputStream in = zipFile.getInputStream( ze ) )
{
extractFileIfIncluded( getSourceFile(), outputDirectory, in,
ze.getName(), new Date( ze.getTime() ), ze.isDirectory(),
ze.getUnixMode() != 0 ? ze.getUnixMode() : null,
resolveSymlink( zipFile, ze ), getFileMappers() );
BoundedInputStream bis = new BoundedInputStream( in, remainingSpace + 1 );
CountingInputStream cis = new CountingInputStream( bis );
extractFile( getSourceFile(), outputDirectory, cis,
ze.getName(), new Date( ze.getTime() ), ze.isDirectory(),
ze.getUnixMode() != 0 ? ze.getUnixMode() : null,
resolveSymlink( zipFile, ze ), getFileMappers() );

remainingSpace -= cis.getByteCount();
if ( remainingSpace < 0 )
{
throw new ArchiverException("Maximum output size limit reached");
}
}
}
}
getLogger().debug( "expand complete" );
}
catch ( final IOException ioe )
{
Expand Down
25 changes: 25 additions & 0 deletions src/test/java/org/codehaus/plexus/archiver/zip/ZipUnArchiverTest.java
View file
Open in desktop
Expand Up @@ -214,6 +214,31 @@ public void testExtractingZipWithEntryOutsideDestDirThrowsException()
assertTrue( ex.getMessage().startsWith( "Entry is outside of the target directory" ) );
}

public void testZipOutputSizeException()
throws Exception
{
Exception ex = null;
String s = "target/zip-size-tests";
File testZip = new File( getBasedir(), "src/test/jars/test.zip" );
File outputDirectory = new File( getBasedir(), s );

FileUtils.deleteDirectory( outputDirectory );

try
{
ZipUnArchiver zu = getZipUnArchiver( testZip );
zu.setMaxOutputSize(10L);
zu.extract( "", outputDirectory );
}
catch ( Exception e )
{
ex = e;
}

assertNotNull( ex );
assertTrue( ex.getMessage().startsWith( "Maximum output size limit reached" ) );
}

private ZipArchiver getZipArchiver()
{
try
Expand Down