From 0ff214d0b11db1001dd158e11d6cd6b368e7c3f0 Mon Sep 17 00:00:00 2001 From: kl Date: Thu, 8 Oct 2026 14:17:07 +0800 Subject: [PATCH] test: verify existing archive traversal protection --- .../ArchiveTraversalSecurityTests.java | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java diff --git a/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java b/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java new file mode 100644 index 00000000..db67e46d --- /dev/null +++ b/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java @@ -0,0 +1,36 @@ +package cn.keking.service; + +import cn.keking.config.ConfigConstants; +import cn.keking.model.FileAttribute; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.io.TempDir; + +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.zip.ZipEntry; +import java.util.zip.ZipOutputStream; + +import static org.junit.jupiter.api.Assertions.*; + +class ArchiveTraversalSecurityTests { + @TempDir Path temp; + + @Test void existingExtractorRejectsZipSlipBeforeWritingOutsideArchive() throws Exception { + String previous = ConfigConstants.getFileDir(); + ConfigConstants.setFileDirValue(temp.toString()); + try { + Path archive = temp.resolve("malicious.zip"); + try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) { + zip.putNextEntry(new ZipEntry("../outside-marker.txt")); + zip.write("BENIGN-CANARY".getBytes()); + zip.closeEntry(); + } + Exception error = assertThrows(Exception.class, () -> new CompressFileReader(null) + .unRar(archive.toString(), "", "malicious.zip", new FileAttribute())); + assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString()); + assertFalse(Files.exists(temp.resolve("outside-marker.txt"))); + } finally { + ConfigConstants.setFileDirValue(previous); + } + } +}