domma-cms 1.7.1 → 1.7.2

package/server/services/wpImport/zip.js

@@ -0,0 +1,142 @@
+/**
+ * Reading a .zip without trusting it - for the WordPress export (an .xml in a
+ * .zip) and the site's uploads folder (wp-content/uploads zipped up).
+ *
+ * Defences:
+ *  - zip-slip: an entry name that is absolute, has a drive letter, a
+ *    backslash, a NUL or a ".." segment is refused outright - and nothing here
+ *    ever writes an entry to disk under its own name anyway; callers get bytes
+ *    and choose a sanitised name themselves.
+ *  - zip bombs: a ceiling on entries, on each entry's size, on the total, and
+ *    on the compression ratio; inflation is capped at the size the entry
+ *    declares (`maxOutputLength`), so a lying header cannot expand further.
+ *  - encrypted entries and ZIP64 archives are refused with a clear message.
+ *
+ * The archive is read with positioned reads from its file, never loaded whole.
+ *
+ * @module services/wpImport/zip
+ */
+import fs from 'node:fs/promises';
+import zlib from 'node:zlib';
+import {promisify} from 'node:util';
+
+const inflateRaw = promisify(zlib.inflateRaw);
+
+export const ZIP_LIMITS = Object.freeze({
+    maxEntries: 50_000,
+    maxEntryBytes: 64 * 1024 * 1024,
+    maxTotalBytes: 4 * 1024 * 1024 * 1024,
+    maxRatio: 200
+});
+
+export class ZipError extends Error {
+    constructor(message) { super(message); this.code = 'EZIP'; }
+}
+
+/**
+ * Is this a name we will look at? Rejects every path-escape trick.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function safeEntryName(name) {
+    const s = String(name ?? '');
+    if (!s || s.length > 1024) return false;
+    if (s.includes('\0') || s.includes('\\')) return false;
+    if (s.startsWith('/') || /^[a-zA-Z]:/.test(s)) return false;
+    return !s.split('/').some(seg => seg === '..');
+}
+
+/**
+ * Open a zip file.
+ *
+ * @param {string} file
+ * @param {Partial<typeof ZIP_LIMITS>} [limits]
+ * @returns {Promise<{entries: {name: string, size: number, compressedSize: number, method: number, offset: number}[],
+ *   unsafe: string[], read: (entry: object) => Promise<Buffer>, close: () => Promise<void>}>}
+ */
+export async function openZip(file, limits = {}) {
+    const lim = {...ZIP_LIMITS, ...limits};
+    const fh = await fs.open(file, 'r');
+    try {
+        const {size} = await fh.stat();
+        if (size < 22) throw new ZipError('Not a zip file.');
+        const tailLen = Math.min(size, 22 + 0xffff);
+        const tail = Buffer.alloc(tailLen);
+        await fh.read(tail, 0, tailLen, size - tailLen);
+        let eocd = -1;
+        for (let p = tailLen - 22; p >= 0; p--) {
+            if (tail.readUInt32LE(p) === 0x06054b50) { eocd = p; break; }
+        }
+        if (eocd === -1) throw new ZipError('Not a zip file (no end-of-archive record).');
+        const total = tail.readUInt16LE(eocd + 10);
+        const cdSize = tail.readUInt32LE(eocd + 12);
+        const cdOffset = tail.readUInt32LE(eocd + 16);
+        if (total === 0xffff || cdSize === 0xffffffff || cdOffset === 0xffffffff) {
+            throw new ZipError('This zip is in the ZIP64 format (over 4 GB or 65,535 files), which is not supported. Zip a smaller part of the folder.');
+        }
+        if (total > lim.maxEntries) throw new ZipError(`The zip holds ${total} files - more than ${lim.maxEntries}.`);
+        if (cdOffset + cdSize > size) throw new ZipError('The zip is damaged (its directory runs past the end).');
+        const cd = Buffer.alloc(cdSize);
+        await fh.read(cd, 0, cdSize, cdOffset);
+
+        const entries = [];
+        const unsafe = [];
+        let sum = 0;
+        let p = 0;
+        for (let n = 0; n < total; n++) {
+            if (p + 46 > cd.length || cd.readUInt32LE(p) !== 0x02014b50) throw new ZipError('The zip is damaged (a bad directory entry).');
+            const flags = cd.readUInt16LE(p + 8);
+            const method = cd.readUInt16LE(p + 10);
+            const compressedSize = cd.readUInt32LE(p + 20);
+            const uncompressed = cd.readUInt32LE(p + 24);
+            const nameLen = cd.readUInt16LE(p + 28);
+            const extraLen = cd.readUInt16LE(p + 30);
+            const commentLen = cd.readUInt16LE(p + 32);
+            const offset = cd.readUInt32LE(p + 42);
+            const name = cd.toString(flags & 0x800 ? 'utf8' : 'latin1', p + 46, p + 46 + nameLen);
+            p += 46 + nameLen + extraLen + commentLen;
+            if (name.endsWith('/')) continue; // a folder
+            if (!safeEntryName(name)) { unsafe.push(name.slice(0, 200)); continue; }
+            if (flags & 0x1) throw new ZipError(`"${name}" is encrypted - zip the folder without a password.`);
+            if (method !== 0 && method !== 8) throw new ZipError(`"${name}" uses a compression method this importer cannot read (only stored and deflate).`);
+            if (uncompressed > lim.maxEntryBytes) continue; // too big to import - reported by the caller as missing
+            if (compressedSize > 0 && uncompressed > 1024 * 1024 && uncompressed / compressedSize > lim.maxRatio) {
+                throw new ZipError(`"${name}" expands ${Math.round(uncompressed / compressedSize)} times - refused as a likely zip bomb.`);
+            }
+            sum += uncompressed;
+            if (sum > lim.maxTotalBytes) throw new ZipError('The zip expands to more than the importer accepts.');
+            entries.push({name, size: uncompressed, compressedSize, method, offset});
+        }
+
+        return {
+            entries,
+            unsafe,
+            async read(entry) {
+                const head = Buffer.alloc(30);
+                await fh.read(head, 0, 30, entry.offset);
+                if (head.readUInt32LE(0) !== 0x04034b50) throw new ZipError(`"${entry.name}" is damaged.`);
+                const start = entry.offset + 30 + head.readUInt16LE(26) + head.readUInt16LE(28);
+                if (start + entry.compressedSize > size) throw new ZipError(`"${entry.name}" runs past the end of the zip.`);
+                const raw = Buffer.alloc(entry.compressedSize);
+                if (entry.compressedSize) await fh.read(raw, 0, entry.compressedSize, start);
+                if (entry.method === 0) {
+                    if (entry.compressedSize !== entry.size) throw new ZipError(`"${entry.name}" is damaged.`);
+                    return raw;
+                }
+                let out;
+                try {
+                    out = await inflateRaw(raw, {maxOutputLength: Math.max(1, entry.size)});
+                } catch (err) {
+                    throw new ZipError(`"${entry.name}" could not be unpacked: ${err.code === 'ERR_BUFFER_TOO_LARGE' ? 'it is bigger than it says' : err.message}.`);
+                }
+                if (out.length !== entry.size) throw new ZipError(`"${entry.name}" is not the size it says.`);
+                return out;
+            },
+            close: () => fh.close()
+        };
+    } catch (err) {
+        await fh.close().catch(() => {});
+        throw err;
+    }
+}