Merge pull request #23 from umjammer/1.1.5

1.1.5
umjammer · Feb 21, 2024 · 1ff6de0 · 1ff6de0
2 parents bd94059 + bfd53af
commit 1ff6de0
Show file tree

Hide file tree

Showing 8 changed files with 43 additions and 30 deletions.
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -30,11 +30,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,7 +45,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: '17'
         distribution: 'temurin'
@@ -65,4 +65,4 @@ jobs:
       run: mvn -B package --file pom.xml -Dmaven.test.skip=true
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -16,14 +16,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Check w/o SNAPSHOT when "bump version"
         if: ${{ contains(github.event.head_commit.message, 'bump version') }}
         run: grep "<version>" pom.xml | head -1 | grep -v SNAPSHOT
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: '17'
           distribution: 'temurin'

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 [![](https://jitpack.io/v/umjammer/vavi-util-archive.svg)](https://jitpack.io/#umjammer/vavi-util-archive)
 [![Java CI](https://github.com/umjammer/vavi-util-archive/actions/workflows/maven.yml/badge.svg)](https://github.com/umjammer/vavi-util-archive/actions/workflows/maven.yml)
-[![CodeQL](https://github.com/umjammer/vavi-util-archive/workflows/CodeQL/badge.svg)](https://github.com/umjammer/vavi-util-archive-sandbox/actions)
+[![CodeQL](https://github.com/umjammer/vavi-util-archive/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/umjammer/vavi-util-archive/actions/workflows/codeql-analysis.yml)
 ![Java](https://img.shields.io/badge/Java-17-b07219)
 
 # vavi-util-archive

diff --git a/pom.xml b/pom.xml
@@ -8,7 +8,7 @@
 
   <groupId>vavi</groupId>
   <artifactId>vavi-util-archive</artifactId>
-  <version>1.1.4</version>
+  <version>1.1.5</version>
 
   <name>Vavi Archiving SPI</name>
   <url>https://github.com/umjammer/vavi-util-archive</url>

diff --git a/src/main/java/vavi/util/archive/gca/NativeGcaArchive.java b/src/main/java/vavi/util/archive/gca/NativeGcaArchive.java
@@ -95,15 +95,16 @@ public Entry getEntry(String name) {
     @Override
     public InputStream getInputStream(Entry entry) throws IOException {
 
+        String tmp = System.getProperty("java.io.tmpdir");
+
         String commandLine = MessageFormat.format(commandLineBase,
                                                   file.getPath(),
-                                                  System.getProperty("java.io.tmpdir"),
+                                                  tmp,
                                                   entry.getName());
 Debug.println("commandLine: " + commandLine);
 
         exec(commandLine);
 
-        String tmp = System.getProperty("java.io.tmpdir");
         Path temporaryFile = Path.of(tmp, entry.getName());
         if (!temporaryFile.normalize().startsWith(tmp)) {
             throw new IOException("Bad zip entry: " + entry.getName());

diff --git a/src/main/java/vavi/util/archive/rar/NativeRarArchive.java b/src/main/java/vavi/util/archive/rar/NativeRarArchive.java
@@ -11,6 +11,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.Date;
@@ -33,7 +34,7 @@
 public class NativeRarArchive implements Archive {
 
     /** */
-    private List<CommonEntry> entries = new ArrayList<>();
+    private final List<CommonEntry> entries = new ArrayList<>();
 
     /** */
     private File file;
@@ -55,8 +56,7 @@ public NativeRarArchive(File file) throws IOException {
                 entry.setCrc(getCurrentCRC());
                 entry.setMethod(getCurrentMethod());
                 entry.setName(currentFilename);
-                entry.setTime(DateUtil.dosDateTimeToLong(getCurrentDate(),
-                                                         getCurrentTime()));
+                entry.setTime(DateUtil.dosDateTimeToLong(getCurrentDate(), getCurrentTime()));
                 entries.add(entry);
 System.err.println(StringUtil.paramString(entry));
 System.err.println("time: " + new Date(entry.getTime()));
@@ -95,20 +95,24 @@ public Entry getEntry(String name) {
     @Override
     public InputStream getInputStream(Entry entry) throws IOException {
 
+        String tmp = System.getProperty("java.io.tmpdir");
+
         String commandLine = MessageFormat.format(commandLineBase,
                                                   file.getPath(),
-                                                  System.getProperty("java.io.tmpdir"),
+                                                  tmp,
                                                   entry.getName());
 Debug.println("commandLine: " + commandLine);
 
         exec(commandLine);
 
-        String temporaryFileName = System.getProperty("java.io.tmpdir") + entry.getName();
-        File temporaryFile = new File(temporaryFileName);
-        if (temporaryFile.exists()) {
-            return new BufferedInputStream(Files.newInputStream(temporaryFile.toPath()));
+        Path temporaryFile = Path.of(tmp, entry.getName());
+        if (!temporaryFile.normalize().startsWith(tmp)) {
+            throw new IOException("Bad zip entry: " + entry.getName());
+        }
+        if (Files.exists(temporaryFile)) {
+            return new BufferedInputStream(Files.newInputStream(temporaryFile));
         } else {
-            throw new IOException("cannot extract: " + temporaryFileName);
+            throw new IOException("cannot extract: " + temporaryFile);
         }
     }
 

diff --git a/src/main/java/vavi/util/archive/sevenzip/NativeSevenZipArchive.java b/src/main/java/vavi/util/archive/sevenzip/NativeSevenZipArchive.java
@@ -11,6 +11,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.Date;
@@ -116,12 +117,14 @@ public InputStream getInputStream(Entry entry) throws IOException {
  throw e;
 }
 
-        String temporaryFileName = temporaryDirectoryString + File.separator + entry.getName();
-        File temporaryFile = new File(temporaryFileName);
-        if (temporaryFile.exists()) {
-            return new BufferedInputStream(Files.newInputStream(temporaryFile.toPath()));
+        Path temporaryFile = Path.of(temporaryDirectoryString, entry.getName());
+        if (!temporaryFile.normalize().startsWith(temporaryDirectoryString)) {
+            throw new IOException("Bad zip entry: " + entry.getName());
+        }
+        if (Files.exists(temporaryFile)) {
+            return new BufferedInputStream(Files.newInputStream(temporaryFile));
         } else {
-            throw new IOException("cannpt extract: " + temporaryFileName);
+            throw new IOException("cannpt extract: " + temporaryFile);
         }
     }
 

diff --git a/src/main/java/vavi/util/archive/stuffit/NativeStuffItArchive.java b/src/main/java/vavi/util/archive/stuffit/NativeStuffItArchive.java
@@ -11,6 +11,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.List;
@@ -70,20 +71,24 @@ public Entry getEntry(String name) {
     @Override
     public InputStream getInputStream(Entry entry) throws IOException {
 
+        String tmp = System.getProperty("java.io.tmpdir");
+
         String commandLine = MessageFormat.format("e \"{0}\" \"{1}\" \"{2}\"",
                                                   file.getPath(),
-                                                  System.getProperty("java.io.tmpdir"),
+                                                  tmp,
                                                   entry.getName());
 Debug.println("commandLine: " + commandLine);
 
         exec(commandLine);
 
-        String temporaryFileName = System.getProperty("java.io.tmpdir") + entry.getName();
-        File temporaryFile = new File(temporaryFileName);
-        if (temporaryFile.exists()) {
-            return new BufferedInputStream(Files.newInputStream(temporaryFile.toPath()));
+        Path temporaryFile = Path.of(tmp, entry.getName());
+        if (!temporaryFile.normalize().startsWith(tmp)) {
+            throw new IOException("Bad zip entry: " + entry.getName());
+        }
+        if (Files.exists(temporaryFile)) {
+            return new BufferedInputStream(Files.newInputStream(temporaryFile));
         } else {
-            throw new IOException("cannot extract: " + temporaryFileName);
+            throw new IOException("cannot extract: " + temporaryFile);
         }
     }