Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Introduced protections against "zip slip" attacks #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Introduced protections against "zip slip" attacks #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion interlok-core/src/test/java/com/adaptris/core/lms/ZipFileBackedMessageTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

package com.adaptris.core.lms;

import io.github.pixee.security.ZipSecurity;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNotSame;
Expand Down Expand Up @@ -188,7 +189,7 @@ public void testCreateCompressedFile() throws Exception {
}

// Check if the InputStream from the message also yields compressed data
try (ZipInputStream zin = new ZipInputStream(orig.getInputStream());
try (ZipInputStream zin = ZipSecurity.createHardenedInputStream(orig.getInputStream());
ByteArrayOutputStream out = new ByteArrayOutputStream()) {
zin.getNextEntry();
IOUtils.copy(zin, out);
Expand Down
361 changes: 181 additions & 180 deletions interlok-core/src/test/java/com/adaptris/core/services/aggregator/ZipAggregatorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,180 +1,181 @@
package com.adaptris.core.services.aggregator;

import static com.adaptris.core.services.aggregator.ZipAggregator.DEFAULT_FILENAME_METADATA;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.io.ByteArrayInputStream;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;

import com.adaptris.core.AdaptrisMessage;
import com.adaptris.core.AdaptrisMessageFactory;
import com.adaptris.core.CoreException;
import com.adaptris.core.Service;
import com.adaptris.core.services.conditional.conditions.ConditionImpl;
import com.adaptris.core.services.metadata.AddFormattedMetadataService;
import com.adaptris.core.services.splitter.SplitByMetadata;
import com.adaptris.core.stubs.DefectiveMessageFactory;
import com.adaptris.core.stubs.DefectiveMessageFactory.WhenToBreak;

public class ZipAggregatorTest extends AggregatingServiceExample {

@Test
public void testJoinMessage() throws Exception {
ZipAggregator aggr = new ZipAggregator();
AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();

AdaptrisMessage original = fac.newMessage();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "file1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, willBeIgnoredMsg));

boolean isZipped = new ZipInputStream(new ByteArrayInputStream(original.getPayload())).getNextEntry() != null;

assertTrue(isZipped);

Map<String, String> results = zipBytesToResultsMap(original.getPayload());

assertEquals(2, results.size());
assertTrue(results.containsKey("file1.xml"));
assertTrue(results.containsKey("file2.xml"));
assertEquals(results.get("file1.xml"), "<document>hello</document>");
assertEquals(results.get("file2.xml"), "<document>world</document>");
}

@Test
public void testJoinMessageWithFilter() throws Exception {
ZipAggregator aggr = new ZipAggregator();
aggr.setFilterCondition(new MetadataFilenameCondition());
AdaptrisMessage original = AdaptrisMessageFactory.getDefaultInstance().newMessage();

AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "xfile1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world2</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage splitMsg3 = fac.newMessage("<document>world3</document>");
splitMsg3.addMetadata(DEFAULT_FILENAME_METADATA, "xfile3.xml");
AdaptrisMessage splitMsg4 = fac.newMessage("<document>world4</document>");
splitMsg4.addMetadata(DEFAULT_FILENAME_METADATA, "file4.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world4</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, splitMsg3, splitMsg4, willBeIgnoredMsg));

boolean isZipped = new ZipInputStream(new ByteArrayInputStream(original.getPayload())).getNextEntry() != null;

assertTrue(isZipped);

Map<String, String> results = zipBytesToResultsMap(original.getPayload());

assertEquals(2, results.size());
assertTrue(results.containsKey("file2.xml"));
assertTrue(results.containsKey("file4.xml"));
assertEquals(results.get("file2.xml"), "<document>world2</document>");
assertEquals(results.get("file4.xml"), "<document>world4</document>");

}

@Test
public void testAggregate_BrokenOutput() throws Exception {
Assertions.assertThrows(CoreException.class, () -> {
ZipAggregator aggr = new ZipAggregator();
AdaptrisMessage original = new DefectiveMessageFactory(WhenToBreak.OUTPUT).newMessage();
AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "xfile1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world2</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage splitMsg3 = fac.newMessage("<document>world3</document>");
splitMsg3.addMetadata(DEFAULT_FILENAME_METADATA, "xfile3.xml");
AdaptrisMessage splitMsg4 = fac.newMessage("<document>world4</document>");
splitMsg4.addMetadata(DEFAULT_FILENAME_METADATA, "file4.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world4</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, splitMsg3, splitMsg4, willBeIgnoredMsg));
});
}

@Override
protected String getExampleCommentHeader(Object o) {
return super.getExampleCommentHeader(o) + "\n<!--"
+ "\nThis aggregator takes all the files specified by 'filename'; creates a zipfile, and sets that as the payload."
+ "\n-->\n";
}

@Override
protected Object retrieveObjectForSampleConfig() {
return null;
}

@Override
protected List<Service> retrieveObjectsForSampleConfig() {
return createExamples(new SplitByMetadata("comma-separated-list", "value"), new ZipAggregator(),
new AddFormattedMetadataService().withFormatString("%1$s.xml").withMetadataKey("filename")
.withArgumentMetadataKeys(Collections.singletonList("value")));
}

@Override
protected String createBaseFileName(Object object) {
return super.createBaseFileName(object) + "-ZipAggregator";
}

/**
* Returns a Map<String, String> where filename is key and value is file
* contents.
*
* @param bytes
* zip bytes
* @return Map where filename is key and value is file contents
* @throws Exception
*/

private Map<String, String> zipBytesToResultsMap(byte[] bytes) throws Exception {
byte[] buffer = new byte[1024];

Map<String, String> results = new HashMap<>();
ZipInputStream zis = new ZipInputStream(new ByteArrayInputStream(bytes));
try {
ZipEntry ze;
while ((ze = zis.getNextEntry()) != null) {
String fileName = ze.getName();
String contents = "";
int len;
while ((len = zis.read(buffer)) > 0) {
contents += new String(buffer, 0, len);
}
results.put(fileName, contents);
}
} finally {
zis.closeEntry();
zis.close();
}
return results;
}

// Filter out metadata filename values that start with 'x'
private class MetadataFilenameCondition extends ConditionImpl {
@Override
public boolean evaluate(AdaptrisMessage message) throws CoreException {
final String metadataValue = message.getMetadataValue(DEFAULT_FILENAME_METADATA);
if (metadataValue != null && metadataValue.startsWith("x"))
return false;
return true;
}

@Override
public void close() {
throw new RuntimeException();
}
}
}
package com.adaptris.core.services.aggregator;

import static com.adaptris.core.services.aggregator.ZipAggregator.DEFAULT_FILENAME_METADATA;
import io.github.pixee.security.ZipSecurity;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.io.ByteArrayInputStream;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;

import com.adaptris.core.AdaptrisMessage;
import com.adaptris.core.AdaptrisMessageFactory;
import com.adaptris.core.CoreException;
import com.adaptris.core.Service;
import com.adaptris.core.services.conditional.conditions.ConditionImpl;
import com.adaptris.core.services.metadata.AddFormattedMetadataService;
import com.adaptris.core.services.splitter.SplitByMetadata;
import com.adaptris.core.stubs.DefectiveMessageFactory;
import com.adaptris.core.stubs.DefectiveMessageFactory.WhenToBreak;

public class ZipAggregatorTest extends AggregatingServiceExample {

@Test
public void testJoinMessage() throws Exception {
ZipAggregator aggr = new ZipAggregator();
AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();

AdaptrisMessage original = fac.newMessage();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "file1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, willBeIgnoredMsg));

boolean isZipped = new ZipInputStream(new ByteArrayInputStream(original.getPayload())).getNextEntry() != null;

assertTrue(isZipped);

Map<String, String> results = zipBytesToResultsMap(original.getPayload());

assertEquals(2, results.size());
assertTrue(results.containsKey("file1.xml"));
assertTrue(results.containsKey("file2.xml"));
assertEquals(results.get("file1.xml"), "<document>hello</document>");
assertEquals(results.get("file2.xml"), "<document>world</document>");
}

@Test
public void testJoinMessageWithFilter() throws Exception {
ZipAggregator aggr = new ZipAggregator();
aggr.setFilterCondition(new MetadataFilenameCondition());
AdaptrisMessage original = AdaptrisMessageFactory.getDefaultInstance().newMessage();

AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "xfile1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world2</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage splitMsg3 = fac.newMessage("<document>world3</document>");
splitMsg3.addMetadata(DEFAULT_FILENAME_METADATA, "xfile3.xml");
AdaptrisMessage splitMsg4 = fac.newMessage("<document>world4</document>");
splitMsg4.addMetadata(DEFAULT_FILENAME_METADATA, "file4.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world4</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, splitMsg3, splitMsg4, willBeIgnoredMsg));

boolean isZipped = new ZipInputStream(new ByteArrayInputStream(original.getPayload())).getNextEntry() != null;

assertTrue(isZipped);

Map<String, String> results = zipBytesToResultsMap(original.getPayload());

assertEquals(2, results.size());
assertTrue(results.containsKey("file2.xml"));
assertTrue(results.containsKey("file4.xml"));
assertEquals(results.get("file2.xml"), "<document>world2</document>");
assertEquals(results.get("file4.xml"), "<document>world4</document>");

}

@Test
public void testAggregate_BrokenOutput() throws Exception {
Assertions.assertThrows(CoreException.class, () -> {
ZipAggregator aggr = new ZipAggregator();
AdaptrisMessage original = new DefectiveMessageFactory(WhenToBreak.OUTPUT).newMessage();
AdaptrisMessageFactory fac = AdaptrisMessageFactory.getDefaultInstance();
AdaptrisMessage splitMsg1 = fac.newMessage("<document>hello</document>");
splitMsg1.addMetadata(DEFAULT_FILENAME_METADATA, "xfile1.xml");
AdaptrisMessage splitMsg2 = fac.newMessage("<document>world2</document>");
splitMsg2.addMetadata(DEFAULT_FILENAME_METADATA, "file2.xml");
AdaptrisMessage splitMsg3 = fac.newMessage("<document>world3</document>");
splitMsg3.addMetadata(DEFAULT_FILENAME_METADATA, "xfile3.xml");
AdaptrisMessage splitMsg4 = fac.newMessage("<document>world4</document>");
splitMsg4.addMetadata(DEFAULT_FILENAME_METADATA, "file4.xml");
AdaptrisMessage willBeIgnoredMsg = fac.newMessage("<document>world4</document>");
aggr.joinMessage(original, Arrays.asList(splitMsg1, splitMsg2, splitMsg3, splitMsg4, willBeIgnoredMsg));
});
}

@Override
protected String getExampleCommentHeader(Object o) {
return super.getExampleCommentHeader(o) + "\n<!--"
+ "\nThis aggregator takes all the files specified by 'filename'; creates a zipfile, and sets that as the payload."
+ "\n-->\n";
}

@Override
protected Object retrieveObjectForSampleConfig() {
return null;
}

@Override
protected List<Service> retrieveObjectsForSampleConfig() {
return createExamples(new SplitByMetadata("comma-separated-list", "value"), new ZipAggregator(),
new AddFormattedMetadataService().withFormatString("%1$s.xml").withMetadataKey("filename")
.withArgumentMetadataKeys(Collections.singletonList("value")));
}

@Override
protected String createBaseFileName(Object object) {
return super.createBaseFileName(object) + "-ZipAggregator";
}

/**
* Returns a Map<String, String> where filename is key and value is file
* contents.
*
* @param bytes
* zip bytes
* @return Map where filename is key and value is file contents
* @throws Exception
*/

private Map<String, String> zipBytesToResultsMap(byte[] bytes) throws Exception {
byte[] buffer = new byte[1024];

Map<String, String> results = new HashMap<>();
ZipInputStream zis = ZipSecurity.createHardenedInputStream(new ByteArrayInputStream(bytes));
try {
ZipEntry ze;
while ((ze = zis.getNextEntry()) != null) {
String fileName = ze.getName();
String contents = "";
int len;
while ((len = zis.read(buffer)) > 0) {
contents += new String(buffer, 0, len);
}
results.put(fileName, contents);
}
} finally {
zis.closeEntry();
zis.close();
}
return results;
}

// Filter out metadata filename values that start with 'x'
private class MetadataFilenameCondition extends ConditionImpl {
@Override
public boolean evaluate(AdaptrisMessage message) throws CoreException {
final String metadataValue = message.getMetadataValue(DEFAULT_FILENAME_METADATA);
if (metadataValue != null && metadataValue.startsWith("x"))
return false;
return true;
}

@Override
public void close() {
throw new RuntimeException();
}
}
}