open-source/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2026-11-11 22:00:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden every shipped config and isolate archive storage tests

Browse Source
This commit is contained in:
kl
2026-10-08 15:46:27 +08:00
parent 7d311ee02f
commit 3c73d8e0e1
5 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java
View File

@@ -7,6 +7,7 @@ import org.junit.jupiter.api.io.TempDir;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;
@@ -17,18 +18,23 @@ class ArchiveTraversalSecurityTests {
@Test void existingExtractorRejectsZipSlipBeforeWritingOutsideArchive() throws Exception {
String previous = ConfigConstants.getFileDir();
ConfigConstants.setFileDirValue(temp.toString());
try {
Path archive = temp.resolve("malicious.zip");
try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
zip.write("BENIGN-CANARY".getBytes());
zip.closeEntry();
CompressFileReader reader = new CompressFileReader(null);
for (String directory : List.of("first", "second")) {
Path root = Files.createDirectory(temp.resolve(directory));
ConfigConstants.setFileDirValue(root.toString());
Path archive = root.resolve("malicious.zip");
try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
zip.write("BENIGN-CANARY".getBytes());
zip.closeEntry();
}
Exception error = assertThrows(Exception.class, () -> reader
.unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
assertTrue(Files.isDirectory(root.resolve("malicious.zip_")));
assertFalse(Files.exists(root.resolve("outside-marker.txt")));
}
Exception error = assertThrows(Exception.class, () -> new CompressFileReader(null)
.unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
assertFalse(Files.exists(temp.resolve("outside-marker.txt")));
} finally {
ConfigConstants.setFileDirValue(previous);
}