rubyzip 1.1.7 → 1.3.0

data/test/errors_test.rb

@@ -1,8 +1,8 @@
 # encoding: utf-8
+
 require 'test_helper'
 
 class ErrorsTest < MiniTest::Test
-
   def test_rescue_legacy_zip_error
     raise ::Zip::Error
   rescue ::Zip::ZipError
@@ -32,5 +32,4 @@ class ErrorsTest < MiniTest::Test
     raise ::Zip::InternalError
   rescue ::Zip::ZipInternalError
   end
-
 end

data/test/extra_field_test.rb

@@ -2,26 +2,26 @@ require 'test_helper'
 
 class ZipExtraFieldTest < MiniTest::Test
   def test_new
-    extra_pure = ::Zip::ExtraField.new("")
-    extra_withstr = ::Zip::ExtraField.new("foo")
+    extra_pure = ::Zip::ExtraField.new('')
+    extra_withstr = ::Zip::ExtraField.new('foo')
     assert_instance_of(::Zip::ExtraField, extra_pure)
     assert_instance_of(::Zip::ExtraField, extra_withstr)
   end
 
   def test_unknownfield
-    extra = ::Zip::ExtraField.new("foo")
-    assert_equal(extra["Unknown"], "foo")
-    extra.merge("a")
-    assert_equal(extra["Unknown"], "fooa")
-    extra.merge("barbaz")
-    assert_equal(extra.to_s, "fooabarbaz")
+    extra = ::Zip::ExtraField.new('foo')
+    assert_equal(extra['Unknown'], 'foo')
+    extra.merge('a')
+    assert_equal(extra['Unknown'], 'fooa')
+    extra.merge('barbaz')
+    assert_equal(extra.to_s, 'fooabarbaz')
   end
 
   def test_ntfs
     str = "\x0A\x00 \x00\x00\x00\x00\x00\x01\x00\x18\x00\xC0\x81\x17\xE8B\xCE\xCF\x01\xC0\x81\x17\xE8B\xCE\xCF\x01\xC0\x81\x17\xE8B\xCE\xCF\x01"
     extra = ::Zip::ExtraField.new(str)
-    assert(extra.member?("NTFS"))
-    t = ::Zip::DOSTime.at(1410496497.405178)
+    assert(extra.member?('NTFS'))
+    t = ::Zip::DOSTime.at(1_410_496_497.405178)
     assert_equal(t, extra['NTFS'].mtime)
     assert_equal(t, extra['NTFS'].atime)
     assert_equal(t, extra['NTFS'].ctime)
@@ -29,12 +29,12 @@ class ZipExtraFieldTest < MiniTest::Test
 
   def test_merge
     str = "UT\x5\0\x3\250$\r@Ux\0\0"
-    extra1 = ::Zip::ExtraField.new("")
+    extra1 = ::Zip::ExtraField.new('')
     extra2 = ::Zip::ExtraField.new(str)
-    assert(!extra1.member?("UniversalTime"))
-    assert(extra2.member?("UniversalTime"))
+    assert(!extra1.member?('UniversalTime'))
+    assert(extra2.member?('UniversalTime'))
     extra1.merge(str)
-    assert_equal(extra1["UniversalTime"].mtime, extra2["UniversalTime"].mtime)
+    assert_equal(extra1['UniversalTime'].mtime, extra2['UniversalTime'].mtime)
   end
 
   def test_length
@@ -42,19 +42,18 @@ class ZipExtraFieldTest < MiniTest::Test
     extra = ::Zip::ExtraField.new(str)
     assert_equal(extra.local_size, extra.to_local_bin.size)
     assert_equal(extra.c_dir_size, extra.to_c_dir_bin.size)
-    extra.merge("foo")
+    extra.merge('foo')
     assert_equal(extra.local_size, extra.to_local_bin.size)
     assert_equal(extra.c_dir_size, extra.to_c_dir_bin.size)
   end
 
-
   def test_to_s
     str = "UT\x5\0\x3\250$\r@Ux\0\0Te\0\0testit"
     extra = ::Zip::ExtraField.new(str)
     assert_instance_of(String, extra.to_s)
 
     s = extra.to_s
-    extra.merge("foo")
+    extra.merge('foo')
     assert_equal(s.length + 3, extra.to_s.length)
   end
 
@@ -65,14 +64,13 @@ class ZipExtraFieldTest < MiniTest::Test
     extra3 = ::Zip::ExtraField.new(str)
     assert_equal(extra1, extra2)
 
-    extra2["UniversalTime"].mtime = ::Zip::DOSTime.now
+    extra2['UniversalTime'].mtime = ::Zip::DOSTime.now
     assert(extra1 != extra2)
 
-    extra3.create("IUnix")
+    extra3.create('IUnix')
     assert(extra1 != extra3)
 
-    extra1.create("IUnix")
+    extra1.create('IUnix')
     assert_equal(extra1, extra3)
   end
-
 end

data/test/file_extract_directory_test.rb

@@ -3,18 +3,17 @@ require 'test_helper'
 class ZipFileExtractDirectoryTest < MiniTest::Test
   include CommonZipFileFixture
 
-  TEST_OUT_NAME = "test/data/generated/emptyOutDir"
+  TEST_OUT_NAME = 'test/data/generated/emptyOutDir'
 
   def open_zip(&aProc)
-    assert(aProc != nil)
+    assert(!aProc.nil?)
     ::Zip::File.open(TestZipFile::TEST_ZIP4.zip_name, &aProc)
   end
 
   def extract_test_dir(&aProc)
-    open_zip {
-        |zf|
+    open_zip do |zf|
       zf.extract(TestFiles::EMPTY_TEST_DIR, TEST_OUT_NAME, &aProc)
-    }
+    end
   end
 
   def setup
@@ -24,32 +23,31 @@ class ZipFileExtractDirectoryTest < MiniTest::Test
     File.delete(TEST_OUT_NAME) if File.exist? TEST_OUT_NAME
   end
 
-  def test_extractDirectory
+  def test_extract_directory
     extract_test_dir
     assert(File.directory?(TEST_OUT_NAME))
   end
 
-  def test_extractDirectoryExistsAsDir
+  def test_extract_directory_exists_as_dir
     Dir.mkdir TEST_OUT_NAME
     extract_test_dir
     assert(File.directory?(TEST_OUT_NAME))
   end
 
-  def test_extractDirectoryExistsAsFile
-    File.open(TEST_OUT_NAME, "w") { |f| f.puts "something" }
+  def test_extract_directory_exists_as_file
+    File.open(TEST_OUT_NAME, 'w') { |f| f.puts 'something' }
     assert_raises(::Zip::DestinationFileExistsError) { extract_test_dir }
   end
 
-  def test_extractDirectoryExistsAsFileOverwrite
-    File.open(TEST_OUT_NAME, "w") { |f| f.puts "something" }
+  def test_extract_directory_exists_as_file_overwrite
+    File.open(TEST_OUT_NAME, 'w') { |f| f.puts 'something' }
     gotCalled = false
-    extract_test_dir {
-        |entry, destPath|
+    extract_test_dir do |entry, destPath|
       gotCalled = true
       assert_equal(TEST_OUT_NAME, destPath)
       assert(entry.directory?)
       true
-    }
+    end
     assert(gotCalled)
     assert(File.directory?(TEST_OUT_NAME))
   end

data/test/file_extract_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class ZipFileExtractTest < MiniTest::Test
   include CommonZipFileFixture
-  EXTRACTED_FILENAME = "test/data/generated/extEntry"
+  EXTRACTED_FILENAME = 'test/data/generated/extEntry'
   ENTRY_TO_EXTRACT, *REMAINING_ENTRIES = TEST_ZIP.entry_names.reverse
 
   def setup
@@ -10,15 +10,17 @@ class ZipFileExtractTest < MiniTest::Test
     ::File.delete(EXTRACTED_FILENAME) if ::File.exist?(EXTRACTED_FILENAME)
   end
 
+  def teardown
+    ::Zip.reset!
+  end
+
   def test_extract
-    ::Zip::File.open(TEST_ZIP.zip_name) {
-        |zf|
+    ::Zip::File.open(TEST_ZIP.zip_name) do |zf|
       zf.extract(ENTRY_TO_EXTRACT, EXTRACTED_FILENAME)
 
       assert(File.exist?(EXTRACTED_FILENAME))
-      AssertEntry::assert_contents(EXTRACTED_FILENAME,
-                                   zf.get_input_stream(ENTRY_TO_EXTRACT) { |is| is.read })
-
+      AssertEntry.assert_contents(EXTRACTED_FILENAME,
+                                  zf.get_input_stream(ENTRY_TO_EXTRACT) { |is| is.read })
 
       ::File.unlink(EXTRACTED_FILENAME)
 
@@ -26,65 +28,118 @@ class ZipFileExtractTest < MiniTest::Test
       entry.extract(EXTRACTED_FILENAME)
 
       assert(File.exist?(EXTRACTED_FILENAME))
-      AssertEntry::assert_contents(EXTRACTED_FILENAME,
-                                   entry.get_input_stream() { |is| is.read })
-
-    }
+      AssertEntry.assert_contents(EXTRACTED_FILENAME,
+                                  entry.get_input_stream { |is| is.read })
+    end
   end
 
-  def test_extractExists
-    writtenText = "written text"
-    ::File.open(EXTRACTED_FILENAME, "w") { |f| f.write(writtenText) }
+  def test_extract_exists
+    writtenText = 'written text'
+    ::File.open(EXTRACTED_FILENAME, 'w') { |f| f.write(writtenText) }
 
-    assert_raises(::Zip::DestinationFileExistsError) {
-      ::Zip::File.open(TEST_ZIP.zip_name) { |zf|
+    assert_raises(::Zip::DestinationFileExistsError) do
+      ::Zip::File.open(TEST_ZIP.zip_name) do |zf|
         zf.extract(zf.entries.first, EXTRACTED_FILENAME)
-      }
-    }
-    File.open(EXTRACTED_FILENAME, "r") { |f|
+      end
+    end
+    File.open(EXTRACTED_FILENAME, 'r') do |f|
       assert_equal(writtenText, f.read)
-    }
+    end
   end
 
-  def test_extractExistsOverwrite
-    writtenText = "written text"
-    ::File.open(EXTRACTED_FILENAME, "w") { |f| f.write(writtenText) }
+  def test_extract_exists_overwrite
+    writtenText = 'written text'
+    ::File.open(EXTRACTED_FILENAME, 'w') { |f| f.write(writtenText) }
 
     gotCalledCorrectly = false
-    ::Zip::File.open(TEST_ZIP.zip_name) {
-        |zf|
-      zf.extract(zf.entries.first, EXTRACTED_FILENAME) {
-          |entry, extractLoc|
+    ::Zip::File.open(TEST_ZIP.zip_name) do |zf|
+      zf.extract(zf.entries.first, EXTRACTED_FILENAME) do |entry, extractLoc|
         gotCalledCorrectly = zf.entries.first == entry &&
-            extractLoc == EXTRACTED_FILENAME
+                             extractLoc == EXTRACTED_FILENAME
         true
-      }
-    }
+      end
+    end
 
     assert(gotCalledCorrectly)
-    ::File.open(EXTRACTED_FILENAME, "r") {
-        |f|
+    ::File.open(EXTRACTED_FILENAME, 'r') do |f|
       assert(writtenText != f.read)
-    }
+    end
   end
 
-  def test_extractNonEntry
+  def test_extract_non_entry
     zf = ::Zip::File.new(TEST_ZIP.zip_name)
-    assert_raises(Errno::ENOENT) { zf.extract("nonExistingEntry", "nonExistingEntry") }
+    assert_raises(Errno::ENOENT) { zf.extract('nonExistingEntry', 'nonExistingEntry') }
   ensure
     zf.close if zf
   end
 
-  def test_extractNonEntry2
-    outFile = "outfile"
-    assert_raises(Errno::ENOENT) {
+  def test_extract_non_entry_2
+    outFile = 'outfile'
+    assert_raises(Errno::ENOENT) do
       zf = ::Zip::File.new(TEST_ZIP.zip_name)
-      nonEntry = "hotdog-diddelidoo"
+      nonEntry = 'hotdog-diddelidoo'
       assert(!zf.entries.include?(nonEntry))
       zf.extract(nonEntry, outFile)
       zf.close
-    }
+    end
     assert(!File.exist?(outFile))
   end
 
+  def test_extract_incorrect_size
+    # The uncompressed size fields in the zip file cannot be trusted. This makes
+    # it harder for callers to validate the sizes of the files they are
+    # extracting, which can lead to denial of service. See also
+    # https://en.wikipedia.org/wiki/Zip_bomb
+    Dir.mktmpdir do |tmp|
+      real_zip = File.join(tmp, 'real.zip')
+      fake_zip = File.join(tmp, 'fake.zip')
+      file_name = 'a'
+      true_size = 500_000
+      fake_size = 1
+
+      ::Zip::File.open(real_zip, ::Zip::File::CREATE) do |zf|
+        zf.get_output_stream(file_name) do |os|
+          os.write 'a' * true_size
+        end
+      end
+
+      compressed_size = nil
+      ::Zip::File.open(real_zip) do |zf|
+        a_entry = zf.find_entry(file_name)
+        compressed_size = a_entry.compressed_size
+        assert_equal true_size, a_entry.size
+      end
+
+      true_size_bytes = [compressed_size, true_size, file_name.size].pack('LLS')
+      fake_size_bytes = [compressed_size, fake_size, file_name.size].pack('LLS')
+
+      data = File.binread(real_zip)
+      assert data.include?(true_size_bytes)
+      data.gsub! true_size_bytes, fake_size_bytes
+
+      File.open(fake_zip, 'wb') do |file|
+        file.write data
+      end
+
+      Dir.chdir tmp do
+        ::Zip::File.open(fake_zip) do |zf|
+          a_entry = zf.find_entry(file_name)
+          assert_equal fake_size, a_entry.size
+
+          ::Zip.validate_entry_sizes = false
+          a_entry.extract
+          assert_equal true_size, File.size(file_name)
+          FileUtils.rm file_name
+
+          ::Zip.validate_entry_sizes = true
+          error = assert_raises ::Zip::EntrySizeError do
+            a_entry.extract
+          end
+          assert_equal \
+            'Entry a should be 1B but is larger when inflated',
+            error.message
+        end
+      end
+    end
+  end
 end

data/test/file_permissions_test.rb

@@ -0,0 +1,65 @@
+require 'test_helper'
+
+class FilePermissionsTest < MiniTest::Test
+  ZIPNAME = File.join(File.dirname(__FILE__), 'umask.zip')
+  FILENAME = File.join(File.dirname(__FILE__), 'umask.txt')
+
+  def teardown
+    ::File.unlink(ZIPNAME)
+    ::File.unlink(FILENAME)
+  end
+
+  def test_current_umask
+    create_files
+    assert_matching_permissions FILENAME, ZIPNAME
+  end
+
+  def test_umask_000
+    set_umask(0o000) do
+      create_files
+    end
+
+    assert_matching_permissions FILENAME, ZIPNAME
+  end
+
+  def test_umask_066
+    set_umask(0o066) do
+      create_files
+    end
+
+    assert_matching_permissions FILENAME, ZIPNAME
+  end
+
+  def test_umask_027
+    set_umask(0o027) do
+      create_files
+    end
+
+    assert_matching_permissions FILENAME, ZIPNAME
+  end
+
+  def assert_matching_permissions(expected_file, actual_file)
+    assert_equal(
+      ::File.stat(expected_file).mode.to_s(8).rjust(4, '0'),
+      ::File.stat(actual_file).mode.to_s(8).rjust(4, '0')
+    )
+  end
+
+  def create_files
+    ::Zip::File.open(ZIPNAME, ::Zip::File::CREATE) do |zip|
+      zip.comment = 'test'
+    end
+
+    ::File.open(FILENAME, 'w') do |file|
+      file << 'test'
+    end
+  end
+
+  # If anything goes wrong, make sure the umask is restored.
+  def set_umask(umask)
+    saved_umask = ::File.umask(umask)
+    yield
+  ensure
+    ::File.umask(saved_umask)
+  end
+end

data/test/file_split_test.rb

@@ -2,9 +2,9 @@ require 'test_helper'
 
 class ZipFileSplitTest < MiniTest::Test
   TEST_ZIP = TestZipFile::TEST_ZIP2.clone
-  TEST_ZIP.zip_name = "large_zip_file.zip"
-  EXTRACTED_FILENAME = "test/data/generated/extEntrySplit"
-  UNSPLITTED_FILENAME = "test/data/generated/unsplitted.zip"
+  TEST_ZIP.zip_name = 'large_zip_file.zip'
+  EXTRACTED_FILENAME = 'test/data/generated/extEntrySplit'
+  UNSPLITTED_FILENAME = 'test/data/generated/unsplitted.zip'
   ENTRY_TO_EXTRACT = TEST_ZIP.entry_names.first
 
   def setup
@@ -21,40 +21,37 @@ class ZipFileSplitTest < MiniTest::Test
   end
 
   def test_split_method_respond
-    assert_respond_to ::Zip::File, :split, "Does not have split class method"
+    assert_respond_to ::Zip::File, :split, 'Does not have split class method'
   end
 
   def test_split
-    result = ::Zip::File.split(TEST_ZIP.zip_name, 65536, false)
-
-    unless result.nil?
-      Dir["#{TEST_ZIP.zip_name}.*"].sort.each_with_index do |zip_file_name, index|
-        File.open(zip_file_name, 'rb') do |zip_file|
-          zip_file.read([::Zip::File::SPLIT_SIGNATURE].pack('V').size) if index == 0
-          File.open(UNSPLITTED_FILENAME, 'ab') do |file|
-            file << zip_file.read
-          end
+    result = ::Zip::File.split(TEST_ZIP.zip_name, 65_536, false)
+
+    return if result.nil?
+    Dir["#{TEST_ZIP.zip_name}.*"].sort.each_with_index do |zip_file_name, index|
+      File.open(zip_file_name, 'rb') do |zip_file|
+        zip_file.read([::Zip::File::SPLIT_SIGNATURE].pack('V').size) if index == 0
+        File.open(UNSPLITTED_FILENAME, 'ab') do |file|
+          file << zip_file.read
         end
       end
+    end
 
-      ::Zip::File.open(UNSPLITTED_FILENAME) do |zf|
-        zf.extract(ENTRY_TO_EXTRACT, EXTRACTED_FILENAME)
-
-        assert(File.exist?(EXTRACTED_FILENAME))
-        AssertEntry::assert_contents(EXTRACTED_FILENAME,
-                                     zf.get_input_stream(ENTRY_TO_EXTRACT) { |is| is.read })
-
+    ::Zip::File.open(UNSPLITTED_FILENAME) do |zf|
+      zf.extract(ENTRY_TO_EXTRACT, EXTRACTED_FILENAME)
 
-        File.unlink(EXTRACTED_FILENAME)
+      assert(File.exist?(EXTRACTED_FILENAME))
+      AssertEntry.assert_contents(EXTRACTED_FILENAME,
+                                  zf.get_input_stream(ENTRY_TO_EXTRACT) { |is| is.read })
 
-        entry = zf.get_entry(ENTRY_TO_EXTRACT)
-        entry.extract(EXTRACTED_FILENAME)
+      File.unlink(EXTRACTED_FILENAME)
 
-        assert(File.exist?(EXTRACTED_FILENAME))
-        AssertEntry::assert_contents(EXTRACTED_FILENAME,
-                                     entry.get_input_stream() { |is| is.read })
+      entry = zf.get_entry(ENTRY_TO_EXTRACT)
+      entry.extract(EXTRACTED_FILENAME)
 
-      end
+      assert(File.exist?(EXTRACTED_FILENAME))
+      AssertEntry.assert_contents(EXTRACTED_FILENAME,
+                                  entry.get_input_stream { |is| is.read })
     end
   end
 end