azure-pipelines-tasks-webdeployment-common 4.230.5 → 4.230.6

package/Tests/L0.js

@@ -10,6 +10,7 @@ const L1JsonVarSub_1 = require("./L1JsonVarSub");
 const L1JsonVarSubV2_1 = require("./L1JsonVarSubV2");
 const L1ValidateFileEncoding_1 = require("./L1ValidateFileEncoding");
 const L0ParameterParserUtility_1 = require("./L0ParameterParserUtility");
+const L1ZipUtility_1 = require("./L1ZipUtility");
 describe('Web deployment common tests', () => {
     describe('GetMSDeployCmdArgs tests', L0MSDeployUtility_1.runGetMSDeployCmdArgsTests);
     describe('GetWebDeployErrorCode tests', L0MSDeployUtility_1.runGetWebDeployErrorCodeTests);
@@ -22,4 +23,5 @@ describe('Web deployment common tests', () => {
     describe("L1JsonVarSubV2 tests", L1JsonVarSubV2_1.runL1JsonVarSubV2Tests);
     describe("L1ValidateFileEncoding tests", L1ValidateFileEncoding_1.runL1ValidateFileEncodingTests);
     describe("ParameterParserUtility tests", L0ParameterParserUtility_1.runParameterParserUtilityTests);
+    describe("ZipUtility tests", L1ZipUtility_1.runL1ZipUtilityTests);
 });

package/Tests/L0.ts

@@ -8,6 +8,7 @@ import { runL1JsonVarSubTests } from "./L1JsonVarSub";
 import { runL1JsonVarSubV2Tests } from "./L1JsonVarSubV2";
 import { runL1ValidateFileEncodingTests } from "./L1ValidateFileEncoding";
 import { runParameterParserUtilityTests } from "./L0ParameterParserUtility";
+import { runL1ZipUtilityTests } from "./L1ZipUtility";
 
 describe('Web deployment common tests', () => {
     describe('GetMSDeployCmdArgs tests', runGetMSDeployCmdArgsTests);
@@ -21,4 +22,5 @@ describe('Web deployment common tests', () => {
     describe("L1JsonVarSubV2 tests", runL1JsonVarSubV2Tests);
     describe("L1ValidateFileEncoding tests", runL1ValidateFileEncodingTests);
     describe("ParameterParserUtility tests", runParameterParserUtilityTests);
+    describe("ZipUtility tests", runL1ZipUtilityTests);
 });

package/Tests/L1ZipUtility.d.ts

@@ -0,0 +1,2 @@
+/// <reference types="mocha" />
+export declare function runL1ZipUtilityTests(this: Mocha.Suite): void;

package/Tests/L1ZipUtility.js

@@ -0,0 +1,23 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runL1ZipUtilityTests = void 0;
+const path = require("path");
+const assert = require("assert");
+const ziputility_1 = require("../ziputility");
+function runL1ZipUtilityTests() {
+    it("Should skip ZIP entries validation", () => __awaiter(this, void 0, void 0, function* () {
+        const archive = path.join(__dirname, 'L1ZipUtility', 'potentially_malicious.zip');
+        const exists = yield ziputility_1.checkIfFilesExistsInZip(archive, ['index.html']);
+        assert.strictEqual(exists, true);
+    }));
+}
+exports.runL1ZipUtilityTests = runL1ZipUtilityTests;

package/Tests/L1ZipUtility.ts

@@ -0,0 +1,15 @@
+import * as path from 'path';
+import assert = require('assert');
+import { checkIfFilesExistsInZip } from "../ziputility";
+
+export function runL1ZipUtilityTests(this: Mocha.Suite): void {
+
+    it("Should skip ZIP entries validation", async () => {
+        const archive = path.join(__dirname, 'L1ZipUtility', 'potentially_malicious.zip');
+
+        const exists = await checkIfFilesExistsInZip(archive, ['index.html']);
+
+        assert.strictEqual(exists, true);
+    });
+
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "azure-pipelines-tasks-webdeployment-common",
-    "version": "4.230.5",
+    "version": "4.230.6",
     "description": "Common Lib for MSDeploy Utility",
     "repository": {
         "type": "git",

package/ziputility.d.ts

@@ -4,4 +4,4 @@ export declare function archiveFolder(folderPath: any, targetPath: any, zipName:
  *  Returns array of files present in archived package
  */
 export declare function getArchivedEntries(archivedPackage: string): Promise<any>;
-export declare function checkIfFilesExistsInZip(archivedPackage: string, files: string[]): any;
+export declare function checkIfFilesExistsInZip(archivedPackage: string, files: string[]): Promise<boolean>;

package/ziputility.js

@@ -157,27 +157,28 @@ function getArchivedEntries(archivedPackage) {
 }
 exports.getArchivedEntries = getArchivedEntries;
 function checkIfFilesExistsInZip(archivedPackage, files) {
-    let deferred = Q.defer();
-    for (let i = 0; i < files.length; i++) {
-        files[i] = files[i].toLowerCase();
-    }
-    const zip = new StreamZip({
-        file: archivedPackage,
-        storeEntries: true
-    });
-    zip.on('ready', () => {
-        let fileCount = 0;
-        for (let entry in zip.entries()) {
-            if (files.indexOf(entry.toLowerCase()) != -1) {
-                fileCount += 1;
-            }
+    return new Promise((resolve, reject) => {
+        for (let i = 0; i < files.length; i++) {
+            files[i] = files[i].toLowerCase();
         }
-        zip.close();
-        deferred.resolve(fileCount == files.length);
-    });
-    zip.on('error', error => {
-        deferred.reject(error);
+        const zip = new StreamZip({
+            file: archivedPackage,
+            storeEntries: true,
+            skipEntryNameValidation: true
+        });
+        zip.on('ready', () => {
+            let fileCount = 0;
+            for (let entry in zip.entries()) {
+                if (files.indexOf(entry.toLowerCase()) !== -1) {
+                    fileCount++;
+                }
+            }
+            zip.close();
+            resolve(fileCount === files.length);
+        });
+        zip.on('error', error => {
+            reject(error);
+        });
     });
-    return deferred.promise;
 }
 exports.checkIfFilesExistsInZip = checkIfFilesExistsInZip;