@zip.js/zip.js 2.8.53 → 2.8.54

package/lib/core/zip-reader.js

@@ -37,6 +37,8 @@ import {
 	COMPRESSION_METHOD_STORE,
 	COMPRESSION_METHOD_AES,
 	SPLIT_ZIP_FILE_SIGNATURE,
+	TEMPORARY_SPLIT_ZIP_FILE_SIGNATURE,
+	SPLIT_ZIP_FILE_SIGNATURE_LENGTH,
 	DATA_DESCRIPTOR_RECORD_SIGNATURE,
 	DATA_DESCRIPTOR_RECORD_LENGTH,
 	DATA_DESCRIPTOR_RECORD_ZIP_64_LENGTH,
@@ -90,7 +92,6 @@ import {
 	FILE_ATTR_UNIX_SETGID_MASK,
 	FILE_ATTR_UNIX_STICKY_MASK,
 	NUMBER_TYPE,
-	STRING_TYPE,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
@@ -167,7 +168,11 @@ import {
 	OPTION_USE_WEB_WORKERS,
 	OPTION_USE_COMPRESSION_STREAM,
 	OPTION_TRANSFER_STREAMS,
-	OPTION_PREVENT_CLOSE
+	OPTION_PREVENT_CLOSE,
+	checkFunctionOption,
+	checkSignalOption,
+	checkPasswordOption,
+	toNumber
 } from "./options.js";
 
 const ERR_BAD_FORMAT = "File format is not recognized";
@@ -181,6 +186,7 @@ const ERR_UNSUPPORTED_ENCRYPTION = "Encryption method not supported";
 const ERR_UNSUPPORTED_COMPRESSION = "Compression method not supported";
 const ERR_SPLIT_ZIP_FILE = "Split zip file";
 const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
+const ERR_ENTRY_DATA_OUT_OF_BOUNDS = "Entry data out of bounds";
 const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
 const ERR_UNSAFE_FILENAME = "Unsafe filename";
@@ -210,6 +216,7 @@ const ZIP64_EXTRACTION = {
 	}
 };
 const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+const MAX_DEFLATE_EXPANSION_RATIO = 1032;
 const CENTRAL_DIRECTORY_UNREACHABLE = 0;
 const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
 const CENTRAL_DIRECTORY_REACHABLE = 2;
@@ -220,7 +227,6 @@ class ZipReader {
 		Object.assign(this, {
 			reader: new GenericReader(reader),
 			options,
-			config: getConfiguration(),
 			readRanges: new Map()
 		});
 	}
@@ -228,7 +234,6 @@ class ZipReader {
 	async* getEntriesGenerator(options = {}) {
 		const zipReader = this;
 		let { reader } = zipReader;
-		const { config } = zipReader;
 		await initStream(reader);
 		if (reader.size === UNDEFINED_VALUE || !reader.readUint8Array) {
 			reader = new BlobReader(await streamToBlob(reader.readable));
@@ -245,9 +250,7 @@ class ZipReader {
 		const normalizeFilename = getOptionValue(zipReader, options, OPTION_NORMALIZE_FILENAME);
 		const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 		if (!endOfDirectoryInfo) {
-			const signatureArray = await readUint8Array(reader, 0, 4);
-			const signatureView = getDataView(signatureArray);
-			if (getUint32(signatureView) == SPLIT_ZIP_FILE_SIGNATURE) {
+			if (await startsWithSplitZipSignature(reader)) {
 				throw new Error(ERR_SPLIT_ZIP_FILE);
 			} else {
 				throw new Error(ERR_EOCDR_NOT_FOUND);
@@ -386,7 +389,7 @@ class ZipReader {
 		}
 		zipReader.directoryOffset = directoryDataOffset;
 		zipReader.directoryLength = declaredDirectoryDataLength;
-		const decryptCentralDirectory = getOptionValue(zipReader, options, OPTION_DECRYPT_CENTRAL_DIRECTORY);
+		const decryptCentralDirectory = getFunctionOptionValue(zipReader, options, OPTION_DECRYPT_CENTRAL_DIRECTORY);
 		let decryptedDirectory;
 		if (decryptCentralDirectory && filesLength && directoryArray.length >= 4 &&
 			getUint32(directoryView, 0) != CENTRAL_FILE_HEADER_SIGNATURE &&
@@ -402,7 +405,7 @@ class ZipReader {
 		const filenames = checkAmbiguity ? new Set() : UNDEFINED_VALUE;
 		let duplicateFilename;
 		for (let indexFile = 0; indexFile < filesLength; indexFile++) {
-			const fileEntry = new ZipEntry(reader, config, zipReader.options);
+			const fileEntry = new ZipEntry(reader, zipReader.options);
 			if (offset + CENTRAL_FILE_HEADER_LENGTH > directoryArray.length || getUint32(directoryView, offset) != CENTRAL_FILE_HEADER_SIGNATURE) {
 				if (indexFile == 0 && !decryptedDirectory && (zip64EndOfDirectoryVersion2 || detectEncryptedCentralDirectory(directoryView))) {
 					throw new Error(ERR_ENCRYPTED_CENTRAL_DIRECTORY);
@@ -433,7 +436,7 @@ class ZipReader {
 				archive: Boolean(msdosAttributesRaw & FILE_ATTR_MSDOS_ARCHIVE_MASK)
 			};
 			const offsetFileEntry = getUint32(directoryView, offset + 42);
-			const decode = getOptionValue(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
+			const decode = getFunctionOptionValue(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 			const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 			const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
 			let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
@@ -546,13 +549,17 @@ class ZipReader {
 		if (duplicateFilename) {
 			throwAmbiguousArchive("duplicate filename");
 		}
-		if (checkAmbiguity && (prependedDataLength || (filesLength && startOffset > 0))) {
-			throwAmbiguousArchive("prepended data");
-		}
 		const extractPrependedData = getOptionValue(zipReader, options, OPTION_EXTRACT_PREPENDED_DATA);
 		const extractAppendedData = getOptionValue(zipReader, options, OPTION_EXTRACT_APPENDED_DATA);
+		const splitZipSignatureLength = (checkAmbiguity || extractPrependedData) && filesLength &&
+			startOffset == SPLIT_ZIP_FILE_SIGNATURE_LENGTH && await startsWithSplitZipMarker(reader) ? SPLIT_ZIP_FILE_SIGNATURE_LENGTH : 0;
+		if (checkAmbiguity && (prependedDataLength || (filesLength && startOffset > splitZipSignatureLength))) {
+			throwAmbiguousArchive("prepended data");
+		}
 		if (extractPrependedData) {
-			zipReader.prependedData = startOffset > 0 ? await readUint8Array(reader, 0, startOffset) : EMPTY_UINT8_ARRAY;
+			zipReader.prependedData = startOffset > splitZipSignatureLength ?
+				await readUint8Array(reader, splitZipSignatureLength, startOffset - splitZipSignatureLength) :
+				EMPTY_UINT8_ARRAY;
 		}
 		zipReader.comment = commentLength ? await readUint8Array(reader, commentOffset + END_OF_CENTRAL_DIR_LENGTH, commentLength) : EMPTY_UINT8_ARRAY;
 		if (extractAppendedData) {
@@ -637,6 +644,7 @@ export {
 	ERR_INVALID_COMPRESSED_DATA,
 	ERR_SPLIT_ZIP_FILE,
 	ERR_OVERLAPPING_ENTRY,
+	ERR_ENTRY_DATA_OUT_OF_BOUNDS,
 	ERR_AMBIGUOUS_ARCHIVE,
 	ERR_ENCRYPTED_CENTRAL_DIRECTORY,
 	ERR_UNSAFE_FILENAME,
@@ -648,16 +656,16 @@ export {
 
 class ZipEntry {
 
-	constructor(reader, config, options) {
+	constructor(reader, options) {
 		Object.assign(this, {
 			reader,
-			config,
 			options
 		});
 	}
 
 	async getData(writer, fileEntry, readRanges, options = {}) {
 		const zipEntry = this;
+		const config = getConfiguration();
 		const {
 			reader,
 			index,
@@ -666,7 +674,6 @@ class ZipEntry {
 			extraFieldAES,
 			extraFieldZip64,
 			compressionMethod,
-			config,
 			bitFlag,
 			rawBitFlag,
 			crc32,
@@ -684,6 +691,7 @@ class ZipEntry {
 		let password = getOptionValue(zipEntry, options, OPTION_PASSWORD);
 		let rawPassword = getOptionValue(zipEntry, options, OPTION_RAW_PASSWORD);
 		const passThrough = getOptionValue(zipEntry, options, OPTION_PASS_THROUGH);
+		checkPasswordOption(password, rawPassword);
 		password = password && password.length && password;
 		rawPassword = rawPassword && rawPassword.length && rawPassword;
 		if (extraFieldAES) {
@@ -753,9 +761,12 @@ class ZipEntry {
 			}
 		}
 		const dataOffset = localHeaderOffset + HEADER_SIZE + filenameLength + extraFieldLength;
+		if (dataOffset + compressedSize > reader.size) {
+			throw new Error(ERR_ENTRY_DATA_OUT_OF_BOUNDS);
+		}
 		const size = compressedSize;
 		const readable = toCompatibleReadable(reader.createReadable({ offset: dataOffset, size }));
-		const signal = getOptionValue(zipEntry, options, OPTION_SIGNAL);
+		const signal = checkSignalOption(getOptionValue(zipEntry, options, OPTION_SIGNAL));
 		const checkPasswordOnly = getOptionValue(zipEntry, options, OPTION_CHECK_PASSWORD_ONLY);
 		let checkOverlappingEntry = getOptionValue(zipEntry, options, OPTION_CHECK_OVERLAPPING_ENTRY);
 		const checkOverlappingEntryOnly = getOptionValue(zipEntry, options, OPTION_CHECK_OVERLAPPING_ENTRY_ONLY);
@@ -763,6 +774,8 @@ class ZipEntry {
 			checkOverlappingEntry = true;
 		}
 		const { onstart, onprogress, onend } = options;
+		const compressed = compressionMethod != COMPRESSION_METHOD_STORE && !passThrough;
+		const outputSize = passThrough ? compressedSize : uncompressedSize;
 		const deflate64 = compressionMethod == COMPRESSION_METHOD_DEFLATE_64;
 		let useCompressionStream = getOptionValue(zipEntry, options, OPTION_USE_COMPRESSION_STREAM);
 		if (deflate64) {
@@ -783,9 +796,9 @@ class ZipEntry {
 				checkCrc32,
 				checkAuthenticationCode: getOptionValue(zipEntry, options, OPTION_CHECK_AUTHENTICATION_CODE),
 				passwordVerification: zipCrypto && (dataDescriptor ? ((rawLastModDate >>> 8) & MAX_8_BITS) : ((crc32 >>> 24) & MAX_8_BITS)),
-				outputSize: passThrough ? compressedSize : uncompressedSize,
+				outputSize,
 				crc32,
-				compressed: compressionMethod != 0 && !passThrough,
+				compressed,
 				encrypted,
 				useWebWorkers: getOptionValue(zipEntry, options, OPTION_USE_WEB_WORKERS),
 				useCompressionStream,
@@ -822,11 +835,11 @@ class ZipEntry {
 					writer = new WritableStream();
 				}
 				writer = new GenericWriter(writer);
-				await initStream(writer, passThrough ? compressedSize : uncompressedSize);
+				await initStream(writer, getDecodableOutputSize(outputSize, compressedSize, compressed));
 				({ writable } = writer);
-				const { outputSize } = await runWorker({ readable, writable }, workerOptions);
-				writer.size += outputSize;
-				if (outputSize != (passThrough ? compressedSize : uncompressedSize)) {
+				const { outputSize: writtenSize } = await runWorker({ readable, writable }, workerOptions);
+				writer.size += writtenSize;
+				if (writtenSize != outputSize) {
 					throw new Error(ERR_INVALID_UNCOMPRESSED_SIZE);
 				}
 			}
@@ -1246,10 +1259,28 @@ function getDiskOffset(reader, diskNumber) {
 	return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 }
 
+async function startsWithSplitZipSignature(reader) {
+	return await getFirstSignature(reader) == SPLIT_ZIP_FILE_SIGNATURE;
+}
+
+async function startsWithSplitZipMarker(reader) {
+	const signature = await getFirstSignature(reader);
+	return signature == SPLIT_ZIP_FILE_SIGNATURE || signature == TEMPORARY_SPLIT_ZIP_FILE_SIGNATURE;
+}
+
+async function getFirstSignature(reader) {
+	const signatureArray = await readUint8Array(reader, 0, SPLIT_ZIP_FILE_SIGNATURE_LENGTH);
+	return getUint32(getDataView(signatureArray));
+}
+
 function isStrictnessValue(value) {
 	return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
 }
 
+function getDecodableOutputSize(outputSize, compressedSize, compressed) {
+	return Math.min(outputSize, compressed ? compressedSize * MAX_DEFLATE_EXPANSION_RATIO : compressedSize);
+}
+
 function getStrictness(options, inheritedOptions) {
 	return resolveStrictness(options, resolveStrictness(inheritedOptions, STRICTNESS_BALANCED));
 }
@@ -1463,10 +1494,11 @@ function getOptionValue(zipReader, options, name) {
 	return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 }
 
-function toNumber(value) {
-	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+function getFunctionOptionValue(zipReader, options, name) {
+	return checkFunctionOption(getOptionValue(zipReader, options, name));
 }
 
+
 function getDate(timeRaw) {
 	const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 	return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);