@zip.js/zip.js 2.16.1 → 2.18.0

package/lib/core/zip-reader.js

@@ -108,6 +108,7 @@ import {
 	ERR_INVALID_PASSWORD,
 	ERR_INVALID_UNCOMPRESSED_SIZE,
 	ERR_INVALID_COMPRESSED_DATA,
+	ERR_CODEC_OUT_OF_MEMORY,
 	ERR_ABORT_CHECK_PASSWORD,
 	ERR_WORKER_STARTUP_TIMEOUT
 } from "./codec-pool.js";
@@ -225,7 +226,7 @@ const PARENT_DIRECTORY_REGEXP = /(^|[\\/])\.\.([\\/]|$)/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
-const BITFLAG_AMBIGUITY_MASK = BITFLAG_ENCRYPTED | BITFLAG_DATA_DESCRIPTOR | BITFLAG_LANG_ENCODING_FLAG;
+const BITFLAG_AMBIGUITY_MASK = BITFLAG_ENCRYPTED | BITFLAG_DATA_DESCRIPTOR | BITFLAG_STRONG_ENCRYPTION | BITFLAG_LANG_ENCODING_FLAG;
 const VENDOR_VERSION_AE_1 = 1;
 const ZIP64_PROPERTIES = [
 	[PROPERTY_NAME_UNCOMPRESSED_SIZE, MAX_32_BITS],
@@ -803,6 +804,7 @@ export {
 	ERR_INVALID_PASSWORD,
 	ERR_INVALID_UNCOMPRESSED_SIZE,
 	ERR_INVALID_COMPRESSED_DATA,
+	ERR_CODEC_OUT_OF_MEMORY,
 	ERR_SPLIT_ZIP_FILE,
 	ERR_OVERLAPPING_ENTRY,
 	ERR_ENTRY_DATA_OUT_OF_BOUNDS,
@@ -927,12 +929,12 @@ class ZipEntry {
 			fileEntry.gid = gid;
 		}
 		const checkPasswordOnly = getOptionValue(zipEntry, options, OPTION_CHECK_PASSWORD_ONLY);
-		const encrypted = zipEntry.encrypted && localDirectory.encrypted && (!passThroughEncryption || checkPasswordOnly);
+		const encrypted = zipEntry.encrypted && (!passThroughEncryption || checkPasswordOnly);
 		const zipCrypto = encrypted && !extraFieldAES;
 		if (!passThroughEncryption) {
 			fileEntry.zipCrypto = zipCrypto;
 		}
-		if (encrypted && (localDirectory.rawBitFlag & BITFLAG_STRONG_ENCRYPTION) == BITFLAG_STRONG_ENCRYPTION) {
+		if (encrypted && (zipEntry.rawBitFlag & BITFLAG_STRONG_ENCRYPTION) == BITFLAG_STRONG_ENCRYPTION) {
 			throw new Error(ERR_UNSUPPORTED_ENCRYPTION);
 		}
 		const registeredCodec = passThroughCompression ? UNDEFINED_VALUE : getRegisteredCodec(compressionMethod);
@@ -1025,6 +1027,7 @@ class ZipEntry {
 				({ writable } = writer);
 				const readable = toCompatibleReadable(reader.createReadable({ offset: dataOffset, size }));
 				const { outputSize: writtenSize } = await runWorker({ readable, writable }, workerOptions);
+				throwIfAborted(signal);
 				if (writtenSize != outputSize) {
 					throw Object.assign(new Error(ERR_INVALID_UNCOMPRESSED_SIZE), { outputSize: writtenSize });
 				}
@@ -1171,8 +1174,16 @@ function readCommonFooter(fileEntry, directory, dataView, offset, localDirectory
 	});
 	const extraFieldZip64 = extraField.get(EXTRAFIELD_TYPE_ZIP64);
 	if (extraFieldZip64) {
-		readExtraFieldZip64(extraFieldZip64, directory);
+		if (!readExtraFieldZip64(extraFieldZip64, directory, localDirectory)) {
+			malformedExtraField = true;
+		}
 		directory.extraFieldZip64 = extraFieldZip64;
+	} else if (ZIP64_PROPERTIES.some(([propertyName, max]) => directory[propertyName] == max)) {
+		if (localDirectory) {
+			malformedExtraField = true;
+		} else {
+			throw new Error(ERR_EXTRAFIELD_ZIP64_NOT_FOUND);
+		}
 	}
 	const extraFieldUnicodePath = extraField.get(EXTRAFIELD_TYPE_UNICODE_PATH);
 	if (extraFieldUnicodePath) {
@@ -1185,10 +1196,13 @@ function readCommonFooter(fileEntry, directory, dataView, offset, localDirectory
 		directory.extraFieldUnicodeComment = extraFieldUnicodeComment;
 	}
 	const extraFieldAES = extraField.get(EXTRAFIELD_TYPE_AES);
-	if (extraFieldAES && extraFieldAES.data.length >= 7) {
+	if (extraFieldAES && (compressionMethod == COMPRESSION_METHOD_AES || directory.encrypted) && extraFieldAES.data.length >= 7) {
 		readExtraFieldAES(extraFieldAES, directory, compressionMethod);
 		directory.extraFieldAES = extraFieldAES;
 	} else {
+		if (extraFieldAES) {
+			malformedExtraField = true;
+		}
 		directory.compressionMethod = compressionMethod;
 	}
 	const extraFieldPkwareUnix = extraField.get(EXTRAFIELD_TYPE_PKWARE_UNIX);
@@ -1231,20 +1245,35 @@ function readCommonFooter(fileEntry, directory, dataView, offset, localDirectory
 	return malformedExtraField;
 }
 
-function readExtraFieldZip64(extraFieldZip64, directory) {
+function readExtraFieldZip64(extraFieldZip64, directory, localDirectory) {
 	directory.zip64 = true;
 	const extraFieldView = getDataView(extraFieldZip64.data);
 	const missingProperties = ZIP64_PROPERTIES.filter(([propertyName, max]) => directory[propertyName] == max);
 	const requiredLength = missingProperties.reduce((length, [, max]) => length + ZIP64_EXTRACTION[max].bytes, 0);
 	if (extraFieldZip64.data.length < requiredLength) {
+		if (localDirectory) {
+			return false;
+		}
 		throw new Error(ERR_EXTRAFIELD_ZIP64_NOT_FOUND);
 	}
-	for (let indexMissingProperty = 0, offset = 0; indexMissingProperty < missingProperties.length; indexMissingProperty++) {
-		const [propertyName, max] = missingProperties[indexMissingProperty];
-		const extraction = ZIP64_EXTRACTION[max];
-		directory[propertyName] = extraFieldZip64[propertyName] = extraction.getValue(extraFieldView, offset);
-		offset += extraction.bytes;
+	const values = [];
+	try {
+		for (let indexMissingProperty = 0, offset = 0; indexMissingProperty < missingProperties.length; indexMissingProperty++) {
+			const [, max] = missingProperties[indexMissingProperty];
+			const extraction = ZIP64_EXTRACTION[max];
+			values.push(extraction.getValue(extraFieldView, offset));
+			offset += extraction.bytes;
+		}
+	} catch (error) {
+		if (localDirectory) {
+			return false;
+		}
+		throw error;
 	}
+	missingProperties.forEach(([propertyName], indexMissingProperty) => {
+		directory[propertyName] = extraFieldZip64[propertyName] = values[indexMissingProperty];
+	});
+	return true;
 }
 
 function readExtraFieldUnicode(extraFieldUnicode, propertyName, rawPropertyName, directory, fileEntry) {

package/lib/core/zip-writer.js

@@ -1673,6 +1673,7 @@ async function createFileEntry(reader, writer, { diskNumberStart, lockFileEntry
 			const result = await runWorker({ readable, writable }, workerOptions);
 			compressedSize = result.outputSize;
 			writer.size += compressedSize;
+			throwIfAborted(signal);
 			if (!passThroughCompression) {
 				uncompressedSize = result.inputSize;
 				if (!encrypted || zipCrypto) {

package/lib/zip-core-reader.js

@@ -46,6 +46,7 @@ export {
 	ERR_INVALID_UNCOMPRESSED_SIZE,
 	ERR_INVALID_PASSWORD,
 	ERR_INVALID_COMPRESSED_DATA,
+	ERR_CODEC_OUT_OF_MEMORY,
 	ERR_SPLIT_ZIP_FILE,
 	ERR_OVERLAPPING_ENTRY,
 	ERR_ENTRY_DATA_OUT_OF_BOUNDS,

package/package.json

@@ -3,7 +3,7 @@
   "description": "A JavaScript library to zip and unzip files in the browser, Deno and Node.js",
   "author": "Gildas Lormeau",
   "license": "BSD-3-Clause",
-  "version": "2.16.1",
+  "version": "2.18.0",
   "type": "module",
   "keywords": [
     "zip",