@zip.js/zip.js 2.13.1 → 2.14.0

package/lib/core/codec-worker.js

@@ -78,11 +78,18 @@ async function supportsDeflate(config) {
 		return true;
 	}
 	if (FallbackStream) {
+		return await loadModule(config);
+	}
+	return false;
+}
+
+async function loadModule(config) {
+	if (initModule) {
 		try {
 			await initModule(config);
 			return true;
 		} catch {
-			return false;
+			// ignored
 		}
 	}
 	return false;
@@ -125,26 +132,27 @@ class CodecWorker {
 			terminate() {
 				return new Promise(resolve => {
 					const { worker, busy } = workerData;
-					if (worker) {
-						if (busy) {
-							workerData.resolveTerminated = resolve;
-						} else {
+					if (busy) {
+						workerData.resolveTerminated = resolve;
+					} else {
+						if (worker) {
 							worker.terminate();
-							resolve();
+							workerData.worker = null;
 						}
-						workerData.interface = null;
-					} else {
 						resolve();
 					}
+					workerData.interface = null;
 				});
 			},
 			onTaskFinished() {
 				if (workerData.busy) {
-					const { resolveTerminated } = workerData;
+					const { resolveTerminated, worker } = workerData;
 					if (resolveTerminated) {
 						workerData.resolveTerminated = null;
-						workerData.terminated = true;
-						workerData.worker.terminate();
+						if (worker) {
+							workerData.terminated = true;
+							worker.terminate();
+						}
 						resolveTerminated();
 					}
 					workerData.busy = false;
@@ -201,28 +209,23 @@ function createWorkerInterface(workerData, config) {
 }
 
 async function runWorker({ options, readable, writable, onTaskFinished, workerOptions }, config) {
-	let codecStream, chunkStream;
+	let codecStream, chunkStream, modulePromise;
 	try {
 		if (options.compressed && !options.format) {
 			const deflate = options.codecType.startsWith(CODEC_DEFLATE);
 			const FallbackStream = deflate ? config.CompressionStreamFallback : config.DecompressionStreamFallback;
 			const NativeStream = deflate ? config.CompressionStream : config.DecompressionStream;
 			if (!options.useCompressionStream) {
-				try {
-					await initModule(config);
-				} catch {
-					if (!FallbackStream || FallbackStream.requiresModule) {
-						options.useCompressionStream = true;
-					}
+				if (!await moduleLoaded() && (!FallbackStream || FallbackStream.requiresModule)) {
+					options.useCompressionStream = true;
 				}
 			} else if (FallbackStream && FallbackStream.requiresModule && !supportsDeflateRaw(NativeStream)) {
-				try {
-					await initModule(config);
-				} catch {
-					// ignored
-				}
+				await moduleLoaded();
 			}
 		}
+		if (options.encrypted && !options.zipCrypto) {
+			await moduleLoaded();
+		}
 		codecStream = new CodecStream(options, config);
 		chunkStream = new ChunkStream(getChunkSize(config));
 		await readable
@@ -255,4 +258,11 @@ async function runWorker({ options, readable, writable, onTaskFinished, workerOp
 	} finally {
 		onTaskFinished();
 	}
+
+	function moduleLoaded() {
+		if (!modulePromise) {
+			modulePromise = loadModule(config);
+		}
+		return modulePromise;
+	}
 }

package/lib/core/io.js

@@ -34,6 +34,7 @@ import {
 	FUNCTION_TYPE,
 	UNDEFINED_TYPE,
 	END_OF_CENTRAL_DIR_LENGTH,
+	MAX_16_BITS,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration, getChunkSize, normalizeChunkSize } from "./configuration.js";
@@ -63,6 +64,7 @@ const HTTP_METHOD_GET = "GET";
 const HTTP_RANGE_UNIT = "bytes";
 const DEFAULT_BUFFER_SIZE = 256 * 1024;
 const DEFAULT_MAXIMUM_RANGE_SIZE = 16 * 1024 * 1024;
+const END_OF_CENTRAL_DIR_SEARCH_LENGTH = END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS;
 
 const PROPERTY_NAME_WRITABLE = "writable";
 const DISK_BOUNDARY = Symbol();
@@ -425,16 +427,14 @@ async function initHttpReader(httpReader, sendRequest, getRequestData) {
 		combineSizeEocd
 	} = httpReader;
 	if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == UNDEFINED_TYPE || preventHeadRequest)) {
-		const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, combineSizeEocd ? -END_OF_CENTRAL_DIR_LENGTH : undefined));
+		const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, combineSizeEocd ? -END_OF_CENTRAL_DIR_SEARCH_LENGTH : undefined));
 		const acceptRanges = response.headers.get(HTTP_HEADER_ACCEPT_RANGES);
 		if (!forceRangeRequests && (!acceptRanges || acceptRanges.toLowerCase() != HTTP_RANGE_UNIT)) {
 			throw new Error(ERR_HTTP_RANGE);
 		} else {
-			if (combineSizeEocd) {
-				const eocdCache = new Uint8Array(await response.arrayBuffer());
-				if (response.status == 206 && eocdCache.length == END_OF_CENTRAL_DIR_LENGTH) {
-					httpReader.eocdCache = eocdCache;
-				}
+			let eocdCache;
+			if (combineSizeEocd && response.status == 206) {
+				eocdCache = new Uint8Array(await response.arrayBuffer());
 			}
 			setResourceValidators(httpReader, response);
 			const contentSize = getContentRangeSize(response);
@@ -443,6 +443,9 @@ async function initHttpReader(httpReader, sendRequest, getRequestData) {
 			} else {
 				httpReader.size = contentSize;
 			}
+			if (eocdCache && eocdCache.length && getContentRangeOffset(response) === httpReader.size - eocdCache.length) {
+				httpReader.eocdCache = eocdCache;
+			}
 		}
 	} else {
 		await getContentLength(httpReader, sendRequest, getRequestData);
@@ -458,25 +461,23 @@ async function readUint8ArrayHttpReader(httpReader, index, length, sendRequest,
 		options
 	} = httpReader;
 	if (useRangeHeader || forceRangeRequests) {
-		if (eocdCache && index == size - END_OF_CENTRAL_DIR_LENGTH && length == END_OF_CENTRAL_DIR_LENGTH) {
-			return eocdCache;
-		}
 		if (index >= size || length === 0) {
 			return EMPTY_UINT8_ARRAY;
 		} else {
 			if (index + length > size) {
 				length = size - index;
 			}
+			if (eocdCache && index >= size - eocdCache.length) {
+				const cacheIndex = index - (size - eocdCache.length);
+				return eocdCache.slice(cacheIndex, cacheIndex + length);
+			}
 			const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, index, length));
 			if (response.status != 206) {
 				throw new Error(ERR_HTTP_RANGE);
 			}
-			const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
-			if (contentRangeHeader) {
-				const rangeStart = Number(contentRangeHeader.trim().split(/[\s-]+/)[1]);
-				if (!Number.isNaN(rangeStart) && rangeStart != index) {
-					throw new Error(ERR_HTTP_RANGE);
-				}
+			const rangeStart = getContentRangeOffset(response);
+			if (rangeStart !== UNDEFINED_VALUE && rangeStart != index) {
+				throw new Error(ERR_HTTP_RANGE);
 			}
 			checkResourceValidators(httpReader, response);
 			setResourceValidators(httpReader, response);
@@ -536,12 +537,9 @@ function createRangeReadable(httpReader, offset, size) {
 		if (response.status != 206) {
 			throw new Error(ERR_HTTP_RANGE);
 		}
-		const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
-		if (contentRangeHeader) {
-			const rangeStart = Number(contentRangeHeader.trim().split(/[\s-]+/)[1]);
-			if (!Number.isNaN(rangeStart) && rangeStart != windowOffset) {
-				throw new Error(ERR_HTTP_RANGE);
-			}
+		const rangeStart = getContentRangeOffset(response);
+		if (rangeStart !== UNDEFINED_VALUE && rangeStart != windowOffset) {
+			throw new Error(ERR_HTTP_RANGE);
 		}
 		checkResourceValidators(httpReader, response);
 		setResourceValidators(httpReader, response);
@@ -557,6 +555,16 @@ function createRangeReadable(httpReader, offset, size) {
 	}
 }
 
+function getContentRangeOffset(response) {
+	const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
+	if (contentRangeHeader) {
+		const rangeStart = Number(contentRangeHeader.trim().split(/[\s-]+/)[1]);
+		if (!Number.isNaN(rangeStart)) {
+			return rangeStart;
+		}
+	}
+}
+
 function getContentRangeSize(response) {
 	const contentRangeHeader = response.headers.get(HTTP_HEADER_CONTENT_RANGE);
 	if (contentRangeHeader) {

package/lib/core/streams/aes-crypto-stream.js

@@ -7,8 +7,8 @@
  1. Redistributions of source code must retain the above copyright notice,
  this list of conditions and the following disclaimer.
 
- 2. Redistributions in binary form must reproduce the above copyright 
- notice, this list of conditions and the following disclaimer in 
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
  the documentation and/or other materials provided with the distribution.
 
  3. The names of the authors may not be used to endorse or promote products
@@ -32,12 +32,7 @@
 import { UNDEFINED_VALUE, UNDEFINED_TYPE, FUNCTION_TYPE, EMPTY_UINT8_ARRAY } from "../constants.js";
 import { encodeText } from "./../util/encode-text.js";
 import { concat } from "./../util/array.js";
-import {
-	cipher,
-	codec,
-	misc,
-	mode
-} from "./codecs/sjcl.js";
+import { createEngine as createDefaultEngine, pbkdf2 } from "./codecs/aes-hmac-sha1.js";
 import {
 	ERR_INVALID_PASSWORD,
 	ERR_INVALID_AUTHENTICATION_CODE,
@@ -50,24 +45,21 @@ const RAW_FORMAT = "raw";
 const PBKDF2_ALGORITHM = { name: "PBKDF2" };
 const HASH_ALGORITHM = { name: "HMAC" };
 const HASH_FUNCTION = "SHA-1";
+const PBKDF2_ITERATIONS = 1000;
 const BASE_KEY_ALGORITHM = Object.assign({ hash: HASH_ALGORITHM }, PBKDF2_ALGORITHM);
-const DERIVED_BITS_ALGORITHM = Object.assign({ iterations: 1000, hash: { name: HASH_FUNCTION } }, PBKDF2_ALGORITHM);
+const DERIVED_BITS_ALGORITHM = Object.assign({ iterations: PBKDF2_ITERATIONS, hash: { name: HASH_FUNCTION } }, PBKDF2_ALGORITHM);
 const DERIVED_BITS_USAGE = ["deriveBits"];
 const SALT_LENGTH = [8, 12, 16];
 const KEY_LENGTH = [16, 24, 32];
 const AUTHENTICATION_CODE_LENGTH = 10;
-const COUNTER_DEFAULT_VALUE = [0, 0, 0, 0];
+const PASSWORD_VERIFICATION_LENGTH = 2;
 // deno-lint-ignore valid-typeof
 const CRYPTO_API_SUPPORTED = typeof crypto != UNDEFINED_TYPE;
 const subtle = CRYPTO_API_SUPPORTED && crypto.subtle;
 const SUBTLE_API_SUPPORTED = CRYPTO_API_SUPPORTED && typeof subtle != UNDEFINED_TYPE;
-const codecBytes = codec.bytes;
-const Aes = cipher.aes;
-const CtrGladman = mode.ctrGladman;
-const HmacSha1 = misc.hmacSha1;
 
-let IMPORT_KEY_SUPPORTED = CRYPTO_API_SUPPORTED && SUBTLE_API_SUPPORTED && typeof subtle.importKey == FUNCTION_TYPE;
-let DERIVE_BITS_SUPPORTED = CRYPTO_API_SUPPORTED && SUBTLE_API_SUPPORTED && typeof subtle.deriveBits == FUNCTION_TYPE;
+let DERIVE_BITS_SUPPORTED = SUBTLE_API_SUPPORTED && typeof subtle.importKey == FUNCTION_TYPE && typeof subtle.deriveBits == FUNCTION_TYPE;
+let createEngine = createDefaultEngine;
 
 class AESDecryptionStream extends TransformStream {
 
@@ -85,9 +77,10 @@ class AESDecryptionStream extends TransformStream {
 					ready
 				} = aesCrypto;
 				if (password) {
-					await createDecryptionKeys(aesCrypto, strength, password, subarray(chunk, 0, SALT_LENGTH[strength] + 2));
-					chunk = subarray(chunk, SALT_LENGTH[strength] + 2);
+					await createDecryptionKeys(aesCrypto, strength, password, subarray(chunk, 0, SALT_LENGTH[strength] + PASSWORD_VERIFICATION_LENGTH));
+					chunk = subarray(chunk, SALT_LENGTH[strength] + PASSWORD_VERIFICATION_LENGTH);
 					if (checkPasswordOnly) {
+						disposeEngine(aesCrypto);
 						controller.error(new Error(ERR_ABORT_CHECK_PASSWORD));
 					} else {
 						resolveReady();
@@ -100,23 +93,16 @@ class AESDecryptionStream extends TransformStream {
 			},
 			async flush(controller) {
 				const {
-					ctr,
-					hmac,
+					engine,
 					pendingInput,
 					ready
 				} = this;
-				if (hmac && ctr) {
+				if (engine) {
 					await ready;
-					const chunkToDecrypt = subarray(pendingInput, 0, pendingInput.length - AUTHENTICATION_CODE_LENGTH);
 					const originalAuthenticationCode = subarray(pendingInput, pendingInput.length - AUTHENTICATION_CODE_LENGTH);
-					let decryptedChunkArray = EMPTY_UINT8_ARRAY;
-					if (chunkToDecrypt.length) {
-						const encryptedChunk = toBits(codecBytes, chunkToDecrypt);
-						hmac.update(encryptedChunk);
-						const decryptedChunk = ctr.update(encryptedChunk);
-						decryptedChunkArray = fromBits(codecBytes, decryptedChunk);
-					}
-					const authenticationCode = subarray(fromBits(codecBytes, hmac.digest()), 0, AUTHENTICATION_CODE_LENGTH);
+					const decryptedChunkArray = new Uint8Array(subarray(pendingInput, 0, pendingInput.length - AUTHENTICATION_CODE_LENGTH));
+					engine.process(decryptedChunkArray, true);
+					const authenticationCode = engine.digest();
 					let invalidAuthenticationCode = pendingInput.length < AUTHENTICATION_CODE_LENGTH ? 1 : 0;
 					for (let indexByte = 0; indexByte < AUTHENTICATION_CODE_LENGTH; indexByte++) {
 						invalidAuthenticationCode |= authenticationCode[indexByte] ^ originalAuthenticationCode[indexByte];
@@ -126,6 +112,9 @@ class AESDecryptionStream extends TransformStream {
 					}
 					controller.enqueue(decryptedChunkArray);
 				}
+			},
+			cancel() {
+				disposeEngine(this);
 			}
 		});
 	}
@@ -155,26 +144,24 @@ class AESEncryptionStream extends TransformStream {
 				}
 				const output = new Uint8Array(preamble.length + chunk.length - (chunk.length % BLOCK_LENGTH));
 				output.set(preamble, 0);
-				controller.enqueue(append(aesCrypto, chunk, output, preamble.length, 0));
+				controller.enqueue(append(aesCrypto, chunk, output, preamble.length, 0, false));
 			},
 			async flush(controller) {
 				const {
-					ctr,
-					hmac,
+					engine,
 					pendingInput,
 					ready
 				} = this;
-				if (hmac && ctr) {
+				if (engine) {
 					await ready;
-					let encryptedChunkArray = EMPTY_UINT8_ARRAY;
-					if (pendingInput.length) {
-						const encryptedChunk = ctr.update(toBits(codecBytes, pendingInput));
-						hmac.update(encryptedChunk);
-						encryptedChunkArray = fromBits(codecBytes, encryptedChunk);
-					}
-					const authenticationCode = fromBits(codecBytes, hmac.digest()).slice(0, AUTHENTICATION_CODE_LENGTH);
+					const encryptedChunkArray = new Uint8Array(pendingInput);
+					engine.process(encryptedChunkArray, false);
+					const authenticationCode = subarray(engine.digest(), 0, AUTHENTICATION_CODE_LENGTH);
 					controller.enqueue(concat(encryptedChunkArray, authenticationCode));
 				}
+			},
+			cancel() {
+				disposeEngine(this);
 			}
 		});
 	}
@@ -182,9 +169,14 @@ class AESEncryptionStream extends TransformStream {
 
 export {
 	AESDecryptionStream,
-	AESEncryptionStream
+	AESEncryptionStream,
+	setAESEngine
 };
 
+function setAESEngine(createEngineFunction) {
+	createEngine = createEngineFunction || createDefaultEngine;
+}
+
 function initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength) {
 	Object.assign(aesCrypto, {
 		ready: new Promise(resolve => aesCrypto.resolveReady = resolve),
@@ -194,30 +186,23 @@ function initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength) {
 	});
 }
 
-function append(aesCrypto, input, output, paddingStart, paddingEnd, verifyAuthenticationCode) {
+function append(aesCrypto, input, output, paddingStart, paddingEnd, decrypt) {
 	const {
-		ctr,
-		hmac,
+		engine,
 		pendingInput
 	} = aesCrypto;
 	if (pendingInput.length) {
 		input = concat(pendingInput, input);
 	}
 	const inputLength = input.length - paddingEnd;
-	output = expand(output, paddingStart + (inputLength - (inputLength % BLOCK_LENGTH)));
-	let offset;
-	for (offset = 0; offset <= inputLength - BLOCK_LENGTH; offset += BLOCK_LENGTH) {
-		const inputChunk = toBits(codecBytes, subarray(input, offset, offset + BLOCK_LENGTH));
-		if (verifyAuthenticationCode) {
-			hmac.update(inputChunk);
-		}
-		const outputChunk = ctr.update(inputChunk);
-		if (!verifyAuthenticationCode) {
-			hmac.update(outputChunk);
-		}
-		output.set(fromBits(codecBytes, outputChunk), offset + paddingStart);
+	const alignedLength = inputLength - (inputLength % BLOCK_LENGTH);
+	output = expand(output, paddingStart + alignedLength);
+	if (alignedLength) {
+		const chunk = subarray(output, paddingStart, paddingStart + alignedLength);
+		chunk.set(subarray(input, 0, alignedLength));
+		engine.process(chunk, decrypt);
 	}
-	aesCrypto.pendingInput = subarray(input, offset);
+	aesCrypto.pendingInput = subarray(input, alignedLength);
 	return output;
 }
 
@@ -225,10 +210,17 @@ async function createDecryptionKeys(decrypt, strength, password, preamble) {
 	const passwordVerificationKey = await createKeys(decrypt, strength, password, subarray(preamble, 0, SALT_LENGTH[strength]));
 	const passwordVerification = subarray(preamble, SALT_LENGTH[strength]);
 	if (passwordVerificationKey[0] != passwordVerification[0] || passwordVerificationKey[1] != passwordVerification[1]) {
+		disposeEngine(decrypt);
 		throw new Error(ERR_INVALID_PASSWORD);
 	}
 }
 
+function disposeEngine({ engine }) {
+	if (engine && engine.dispose) {
+		engine.dispose();
+	}
+}
+
 async function createEncryptionKeys(encrypt, strength, password) {
 	const salt = getRandomValues(new Uint8Array(SALT_LENGTH[strength]));
 	const passwordVerification = await createKeys(encrypt, strength, password, salt);
@@ -237,48 +229,22 @@ async function createEncryptionKeys(encrypt, strength, password) {
 
 async function createKeys(aesCrypto, strength, password, salt) {
 	aesCrypto.password = null;
-	const baseKey = await importKey(RAW_FORMAT, password, BASE_KEY_ALGORITHM, false, DERIVED_BITS_USAGE);
-	const derivedBits = await deriveBits(Object.assign({ salt }, DERIVED_BITS_ALGORITHM), baseKey, 8 * ((KEY_LENGTH[strength] * 2) + 2));
-	const compositeKey = new Uint8Array(derivedBits);
-	const key = toBits(codecBytes, subarray(compositeKey, 0, KEY_LENGTH[strength]));
-	const authentication = toBits(codecBytes, subarray(compositeKey, KEY_LENGTH[strength], KEY_LENGTH[strength] * 2));
-	const passwordVerification = subarray(compositeKey, KEY_LENGTH[strength] * 2);
-	Object.assign(aesCrypto, {
-		keys: {
-			key,
-			authentication,
-			passwordVerification
-		},
-		ctr: new CtrGladman(new Aes(key), Array.from(COUNTER_DEFAULT_VALUE)),
-		hmac: new HmacSha1(authentication)
-	});
-	return passwordVerification;
-}
-
-async function importKey(format, password, algorithm, extractable, keyUsages) {
-	if (IMPORT_KEY_SUPPORTED) {
-		try {
-			return await subtle.importKey(format, password, algorithm, extractable, keyUsages);
-		} catch {
-			IMPORT_KEY_SUPPORTED = false;
-			return misc.importKey(password);
-		}
-	} else {
-		return misc.importKey(password);
-	}
+	const keyLength = KEY_LENGTH[strength];
+	const compositeKey = await deriveKey(password, salt, keyLength * 2 + PASSWORD_VERIFICATION_LENGTH);
+	aesCrypto.engine = createEngine(subarray(compositeKey, 0, keyLength), subarray(compositeKey, keyLength, keyLength * 2));
+	return subarray(compositeKey, keyLength * 2);
 }
 
-async function deriveBits(algorithm, baseKey, length) {
+async function deriveKey(password, salt, length) {
 	if (DERIVE_BITS_SUPPORTED) {
 		try {
-			return await subtle.deriveBits(algorithm, baseKey, length);
+			const baseKey = await subtle.importKey(RAW_FORMAT, password, BASE_KEY_ALGORITHM, false, DERIVED_BITS_USAGE);
+			return new Uint8Array(await subtle.deriveBits(Object.assign({ salt }, DERIVED_BITS_ALGORITHM), baseKey, length * 8));
 		} catch {
 			DERIVE_BITS_SUPPORTED = false;
-			return misc.pbkdf2(baseKey, algorithm.salt, DERIVED_BITS_ALGORITHM.iterations, length);
 		}
-	} else {
-		return misc.pbkdf2(baseKey, algorithm.salt, DERIVED_BITS_ALGORITHM.iterations, length);
 	}
+	return pbkdf2(password, salt, PBKDF2_ITERATIONS, length);
 }
 
 function encodePassword(password, rawPassword) {
@@ -301,10 +267,3 @@ function expand(inputArray, length) {
 function subarray(array, begin, end) {
 	return array.subarray(begin, end);
 }
-
-function fromBits(codecBytes, chunk) {
-	return codecBytes.fromBits(chunk);
-}
-function toBits(codecBytes, chunk) {
-	return codecBytes.toBits(chunk);
-}