@zip.js/zip.js 2.8.49 → 2.8.51

package/lib/core/zip-writer.js

@@ -140,6 +140,7 @@ import {
 	UNDEFINED_VALUE,
 	INFINITY_VALUE,
 	OBJECT_TYPE,
+	STRING_TYPE,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
@@ -212,7 +213,9 @@ import {
 	OPTION_USDZ,
 	OPTION_UNIX_EXTRA_FIELD_TYPE,
 	OPTION_LOCAL_EXTRA_FIELD,
-	OPTION_SIGN_CENTRAL_DIRECTORY
+	OPTION_SIGN_CENTRAL_DIRECTORY,
+	TEXT_TYPE_FILENAME,
+	TEXT_TYPE_COMMENT
 } from "./options.js";
 
 const ERR_DUPLICATED_NAME = "File already exists";
@@ -240,6 +243,8 @@ const ERR_INVALID_UNIX_EXTRA_FIELD_TYPE = "Invalid unixExtraFieldType (must be '
 const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
+const ERR_INVALID_LEVEL = "Invalid level (must be integer 0..9)";
+const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 const ERR_INVALID_SIGNATURE_DATA = "Signature data exceeds 64KB";
 
 const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
@@ -247,6 +252,7 @@ const EXTRAFIELD_OFFSET_AES_VENDOR_VERSION = 4;
 const VENDOR_VERSION_AE_1 = 1;
 const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 const UNIX_EXTRA_FIELD_TYPE = "unix";
+const MAX_LEVEL = 9;
 
 let workers = 0;
 const pendingEntries = [];
@@ -409,7 +415,8 @@ class ZipWriter {
 
 	remove(entry) {
 		const { filenames, files } = this;
-		if (typeof entry == "string") {
+		// deno-lint-ignore valid-typeof
+		if (typeof entry == STRING_TYPE) {
 			entry = files.get(entry);
 		}
 		if (entry && entry.filename !== UNDEFINED_VALUE) {
@@ -528,6 +535,8 @@ export {
 	ERR_INVALID_UNIX_ID_SIZE,
 	ERR_INVALID_MSDOS_ATTRIBUTES,
 	ERR_INVALID_MSDOS_DATA,
+	ERR_INVALID_LEVEL,
+	ERR_INVALID_PASSWORD_TYPE,
 	ERR_UNSUPPORTED_CRYPTO_API
 };
 
@@ -574,20 +583,20 @@ function resolveAttributes(zipWriter, name, options) {
 	let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 	let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
 	const executable = getOptionValue(zipWriter, options, PROPERTY_NAME_EXECUTABLE);
-	const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
-	const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
-	let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
+	const uid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UID);
+	const gid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_GID);
+	let unixMode = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
 	let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 	let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 	let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 	let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
-	if (uid !== UNDEFINED_VALUE && (uid < 0 || uid > MAX_32_BITS)) {
+	if (uid !== UNDEFINED_VALUE && (!Number.isInteger(uid) || uid < 0 || uid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_UID);
 	}
-	if (gid !== UNDEFINED_VALUE && (gid < 0 || gid > MAX_32_BITS)) {
+	if (gid !== UNDEFINED_VALUE && (!Number.isInteger(gid) || gid < 0 || gid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_GID);
 	}
-	if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
+	if (unixMode !== UNDEFINED_VALUE && (!Number.isInteger(unixMode) || unixMode < 0 || unixMode > MAX_16_BITS)) {
 		throw new Error(ERR_INVALID_UNIX_MODE);
 	}
 	if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
@@ -699,7 +708,7 @@ function resolveAttributes(zipWriter, name, options) {
 
 function resolveMetadata(zipWriter, name, options) {
 	const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
-	let rawFilename = encode(name);
+	let rawFilename = encode(name, TEXT_TYPE_FILENAME);
 	if (rawFilename === UNDEFINED_VALUE) {
 		rawFilename = encodeText(name);
 	}
@@ -707,7 +716,7 @@ function resolveMetadata(zipWriter, name, options) {
 		throw new Error(ERR_INVALID_ENTRY_NAME);
 	}
 	const comment = options[PROPERTY_NAME_COMMENT] || "";
-	let rawComment = encode(comment);
+	let rawComment = encode(comment, TEXT_TYPE_COMMENT);
 	if (rawComment === UNDEFINED_VALUE) {
 		rawComment = encodeText(comment);
 	}
@@ -727,8 +736,11 @@ function resolveMetadata(zipWriter, name, options) {
 	if (!passThrough) {
 		password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
 		rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+		if ((password && typeof password != STRING_TYPE) || (rawPassword && !(rawPassword instanceof Uint8Array))) {
+			throw new Error(ERR_INVALID_PASSWORD_TYPE);
+		}
 	}
-	const encryptionStrength = getOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
+	const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 	const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 	const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
 	const ntfsTimestamp = getOptionValue(zipWriter, options, OPTION_NTFS_TIMESTAMP);
@@ -746,7 +758,10 @@ function resolveMetadata(zipWriter, name, options) {
 		compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE && !registeredCodec) {
 		throw new Error(ERR_UNSUPPORTED_COMPRESSION);
 	}
-	let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
+	let level = getNumberOptionValue(zipWriter, options, OPTION_LEVEL);
+	if (level !== UNDEFINED_VALUE && (!Number.isInteger(level) || level < 0 || level > MAX_LEVEL)) {
+		throw new Error(ERR_INVALID_LEVEL);
+	}
 	if (zipWriter.options[OPTION_USDZ]) {
 		if (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) {
 			throw new Error(ERR_UNSUPPORTED_ENCRYPTION_USDZ);
@@ -767,7 +782,7 @@ function resolveMetadata(zipWriter, name, options) {
 		useCompressionStream = false;
 	}
 	const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
+	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(Number.isInteger(encryptionStrength) && encryptionStrength >= 1 && encryptionStrength <= 3)) {
 		throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 	}
 	const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
@@ -1961,6 +1976,14 @@ function getOptionValue(zipWriter, options, name, defaultValue) {
 	return result === UNDEFINED_VALUE ? defaultValue : result;
 }
 
+function getNumberOptionValue(zipWriter, options, name, defaultValue) {
+	return toNumber(getOptionValue(zipWriter, options, name, defaultValue));
+}
+
+function toNumber(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getMaximumCompressedSize(uncompressedSize) {
 	return uncompressedSize + (5 * (Math.floor(uncompressedSize / 16383) + 1));
 }

package/lib/zip-core-reader.js

@@ -26,6 +26,8 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import "./core/codec-worker-web.js";
+
 export {
 	ZipReader,
 	ZipReaderStream,
@@ -48,5 +50,9 @@ export {
 	ERR_OVERLAPPING_ENTRY,
 	ERR_AMBIGUOUS_ARCHIVE,
 	ERR_ENCRYPTED_CENTRAL_DIRECTORY,
+	ERR_UNSAFE_FILENAME,
+	ERR_INVALID_STRICTNESS,
+	ERR_INVALID_FILENAME_VALIDATION,
+	ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 	ERR_WORKER_STARTUP_TIMEOUT
 } from "./core/zip-reader.js";

package/lib/zip-core-writer.js

@@ -26,6 +26,8 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import "./core/codec-worker-web.js";
+
 export {
 	ZipWriter,
 	ZipWriterStream,
@@ -50,5 +52,7 @@ export {
 	ERR_INVALID_UNIX_ID_SIZE,
 	ERR_INVALID_MSDOS_ATTRIBUTES,
 	ERR_INVALID_MSDOS_DATA,
+	ERR_INVALID_LEVEL,
+	ERR_INVALID_PASSWORD_TYPE,
 	ERR_UNSUPPORTED_CRYPTO_API
 } from "./core/zip-writer.js";

package/package.json

@@ -3,7 +3,7 @@
   "description": "A JavaScript library to zip and unzip files in the browser, Deno and Node.js",
   "author": "Gildas Lormeau",
   "license": "BSD-3-Clause",
-  "version": "2.8.49",
+  "version": "2.8.51",
   "type": "module",
   "keywords": [
     "zip",