azure-pipelines-tasks-webdeployment-common 4.230.4 → 4.230.6

package/7zip/7zip/License.txt

@@ -3,19 +3,20 @@
   License for use and distribution
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-  7-Zip Copyright (C) 1999-2016 Igor Pavlov.
+  7-Zip Copyright (C) 1999-2019 Igor Pavlov.
 
-  Licenses for files are:
+  The licenses for files are:
 
-    1) 7z.dll: GNU LGPL + unRAR restriction
-    2) All other files:  GNU LGPL
+    1) 7z.dll:
+         - The "GNU LGPL" as main license for most of the code
+         - The "GNU LGPL" with "unRAR license restriction" for some code
+         - The "BSD 3-clause License" for some code
+    2) All other files: the "GNU LGPL".
 
-  The GNU LGPL + unRAR restriction means that you must follow both 
-  GNU LGPL rules and unRAR restriction rules.
+  Redistributions in binary form must reproduce related license information from this file.
 
-
-  Note: 
-    You can use 7-Zip on any computer, including a computer in a commercial 
+  Note:
+    You can use 7-Zip on any computer, including a computer in a commercial
     organization. You don't need to register or pay for 7-Zip.
 
 
@@ -32,21 +33,54 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Lesser General Public License for more details.
 
-    You can receive a copy of the GNU Lesser General Public License from 
+    You can receive a copy of the GNU Lesser General Public License from
     http://www.gnu.org/
 
 
-  unRAR restriction
-  -----------------
 
-    The decompression engine for RAR archives was developed using source 
+
+  BSD 3-clause License
+  --------------------
+
+    The "BSD 3-clause License" is used for the code in 7z.dll that implements LZFSE data decompression.
+    That code was derived from the code in the "LZFSE compression library" developed by Apple Inc,
+    that also uses the "BSD 3-clause License":
+
+    ----
+    Copyright (c) 2015-2016, Apple Inc. All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+    1.  Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+    2.  Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer
+        in the documentation and/or other materials provided with the distribution.
+
+    3.  Neither the name of the copyright holder(s) nor the names of any contributors may be used to endorse or promote products derived
+        from this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+    ----
+
+
+
+
+  unRAR license restriction
+  -------------------------
+
+    The decompression engine for RAR archives was developed using source
     code of unRAR program.
     All copyrights to original unRAR code are owned by Alexander Roshal.
 
     The license for original unRAR code has the following restriction:
 
-      The unRAR sources cannot be used to re-create the RAR compression algorithm, 
-      which is proprietary. Distribution of modified unRAR sources in separate form 
+      The unRAR sources cannot be used to re-create the RAR compression algorithm,
+      which is proprietary. Distribution of modified unRAR sources in separate form
       or as a part of other software is permitted, provided that it is clearly
       stated in the documentation and source comments that the code may
       not be used to develop a RAR (WinRAR) compatible archiver.

package/Tests/L0.js

@@ -10,6 +10,7 @@ const L1JsonVarSub_1 = require("./L1JsonVarSub");
 const L1JsonVarSubV2_1 = require("./L1JsonVarSubV2");
 const L1ValidateFileEncoding_1 = require("./L1ValidateFileEncoding");
 const L0ParameterParserUtility_1 = require("./L0ParameterParserUtility");
+const L1ZipUtility_1 = require("./L1ZipUtility");
 describe('Web deployment common tests', () => {
     describe('GetMSDeployCmdArgs tests', L0MSDeployUtility_1.runGetMSDeployCmdArgsTests);
     describe('GetWebDeployErrorCode tests', L0MSDeployUtility_1.runGetWebDeployErrorCodeTests);
@@ -22,4 +23,5 @@ describe('Web deployment common tests', () => {
     describe("L1JsonVarSubV2 tests", L1JsonVarSubV2_1.runL1JsonVarSubV2Tests);
     describe("L1ValidateFileEncoding tests", L1ValidateFileEncoding_1.runL1ValidateFileEncodingTests);
     describe("ParameterParserUtility tests", L0ParameterParserUtility_1.runParameterParserUtilityTests);
+    describe("ZipUtility tests", L1ZipUtility_1.runL1ZipUtilityTests);
 });

package/Tests/L0.ts

@@ -8,6 +8,7 @@ import { runL1JsonVarSubTests } from "./L1JsonVarSub";
 import { runL1JsonVarSubV2Tests } from "./L1JsonVarSubV2";
 import { runL1ValidateFileEncodingTests } from "./L1ValidateFileEncoding";
 import { runParameterParserUtilityTests } from "./L0ParameterParserUtility";
+import { runL1ZipUtilityTests } from "./L1ZipUtility";
 
 describe('Web deployment common tests', () => {
     describe('GetMSDeployCmdArgs tests', runGetMSDeployCmdArgsTests);
@@ -21,4 +22,5 @@ describe('Web deployment common tests', () => {
     describe("L1JsonVarSubV2 tests", runL1JsonVarSubV2Tests);
     describe("L1ValidateFileEncoding tests", runL1ValidateFileEncodingTests);
     describe("ParameterParserUtility tests", runParameterParserUtilityTests);
+    describe("ZipUtility tests", runL1ZipUtilityTests);
 });

package/Tests/L1ZipUtility.d.ts

@@ -0,0 +1,2 @@
+/// <reference types="mocha" />
+export declare function runL1ZipUtilityTests(this: Mocha.Suite): void;

package/Tests/L1ZipUtility.js

@@ -0,0 +1,23 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runL1ZipUtilityTests = void 0;
+const path = require("path");
+const assert = require("assert");
+const ziputility_1 = require("../ziputility");
+function runL1ZipUtilityTests() {
+    it("Should skip ZIP entries validation", () => __awaiter(this, void 0, void 0, function* () {
+        const archive = path.join(__dirname, 'L1ZipUtility', 'potentially_malicious.zip');
+        const exists = yield ziputility_1.checkIfFilesExistsInZip(archive, ['index.html']);
+        assert.strictEqual(exists, true);
+    }));
+}
+exports.runL1ZipUtilityTests = runL1ZipUtilityTests;

package/Tests/L1ZipUtility.ts

@@ -0,0 +1,15 @@
+import * as path from 'path';
+import assert = require('assert');
+import { checkIfFilesExistsInZip } from "../ziputility";
+
+export function runL1ZipUtilityTests(this: Mocha.Suite): void {
+
+    it("Should skip ZIP entries validation", async () => {
+        const archive = path.join(__dirname, 'L1ZipUtility', 'potentially_malicious.zip');
+
+        const exists = await checkIfFilesExistsInZip(archive, ['index.html']);
+
+        assert.strictEqual(exists, true);
+    });
+
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "azure-pipelines-tasks-webdeployment-common",
-    "version": "4.230.4",
+    "version": "4.230.6",
     "description": "Common Lib for MSDeploy Utility",
     "repository": {
         "type": "git",

package/ziputility.d.ts

@@ -4,4 +4,4 @@ export declare function archiveFolder(folderPath: any, targetPath: any, zipName:
  *  Returns array of files present in archived package
  */
 export declare function getArchivedEntries(archivedPackage: string): Promise<any>;
-export declare function checkIfFilesExistsInZip(archivedPackage: string, files: string[]): any;
+export declare function checkIfFilesExistsInZip(archivedPackage: string, files: string[]): Promise<boolean>;

package/ziputility.js

@@ -157,27 +157,28 @@ function getArchivedEntries(archivedPackage) {
 }
 exports.getArchivedEntries = getArchivedEntries;
 function checkIfFilesExistsInZip(archivedPackage, files) {
-    let deferred = Q.defer();
-    for (let i = 0; i < files.length; i++) {
-        files[i] = files[i].toLowerCase();
-    }
-    const zip = new StreamZip({
-        file: archivedPackage,
-        storeEntries: true
-    });
-    zip.on('ready', () => {
-        let fileCount = 0;
-        for (let entry in zip.entries()) {
-            if (files.indexOf(entry.toLowerCase()) != -1) {
-                fileCount += 1;
-            }
+    return new Promise((resolve, reject) => {
+        for (let i = 0; i < files.length; i++) {
+            files[i] = files[i].toLowerCase();
         }
-        zip.close();
-        deferred.resolve(fileCount == files.length);
-    });
-    zip.on('error', error => {
-        deferred.reject(error);
+        const zip = new StreamZip({
+            file: archivedPackage,
+            storeEntries: true,
+            skipEntryNameValidation: true
+        });
+        zip.on('ready', () => {
+            let fileCount = 0;
+            for (let entry in zip.entries()) {
+                if (files.indexOf(entry.toLowerCase()) !== -1) {
+                    fileCount++;
+                }
+            }
+            zip.close();
+            resolve(fileCount === files.length);
+        });
+        zip.on('error', error => {
+            reject(error);
+        });
     });
-    return deferred.promise;
 }
 exports.checkIfFilesExistsInZip = checkIfFilesExistsInZip;