update tests

am0o0 · am0o0 · commit 59fb479895cd · 2023-10-14T12:28:58.000+02:00
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/HelloServlet.java b/java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/HelloServlet.java
@@ -10,6 +10,8 @@
 
 import java.io.*;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.zip.DataFormatException;
 import javax.servlet.ServletException;
 import javax.servlet.annotation.MultipartConfig;
 import javax.servlet.annotation.WebServlet;
@@ -36,6 +38,16 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
     ZipInputStreamUnsafe(remoteFile.getInputStream());
     GZipInputStreamUnsafe(request.getPart("zipFile").getInputStream());
     InflaterInputStreamUnsafe(request.getPart("zipFile").getInputStream());
+    try {
+      InflaterUnsafe(request.getParameter("data").getBytes(StandardCharsets.UTF_8));
+    } catch (DataFormatException e) {
+      throw new RuntimeException(e);
+    }
+    try {
+      ZipFile1(request.getParameter("zipFileName"));
+    } catch (DataFormatException e) {
+      throw new RuntimeException(e);
+    }
 
     // Zip4j
     zip4jZipInputStream(remoteFile.getInputStream());
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/ZipHandler.java b/java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/ZipHandler.java
@@ -2,7 +2,10 @@
 
 import java.io.*;
 import java.io.FileOutputStream;
+import java.nio.ByteBuffer;
+import java.util.Enumeration;
 import java.util.zip.*;
+import java.util.zip.ZipFile;
 
 public class ZipHandler {
   public static void ZipInputStreamSafe(InputStream inputStream) throws IOException {
@@ -127,4 +130,49 @@ public static void InflaterInputStreamUnsafe(InputStream inputStream) throws jav
       dest.close();
     }
   }
+
+  public static void InflaterUnsafe(byte[] inputBytes) throws DataFormatException, IOException {
+    Inflater inflater = new Inflater();
+    inflater.setInput(inputBytes);
+    try (final ByteArrayOutputStream outputStream = new ByteArrayOutputStream(inputBytes.length)) {
+      byte[] buffer = new byte[1024];
+      while (!inflater.finished()) {
+        final int count = inflater.inflate(buffer);
+        outputStream.write(buffer, 0, count);
+      }
+      outputStream.toByteArray();
+    }
+  }
+
+  public static void ZipFile1(String zipFilePath) throws DataFormatException, IOException {
+    try {
+      System.out.println("zipFilePath = " + zipFilePath);
+      ZipFile zipFile = new ZipFile(zipFilePath);
+      Enumeration<? extends ZipEntry> entries = zipFile.entries();
+      while (entries.hasMoreElements()) {
+        ZipEntry entry = entries.nextElement();
+        if (entry.isDirectory()) {
+          System.out.print("dir  : " + entry.getName());
+          String destPath = "tmp" + File.separator + entry.getName();
+          System.out.println(" => " + destPath);
+          File file = new File(destPath);
+          file.mkdirs();
+        } else {
+          String destPath = "tmp" + File.separator + entry.getName();
+
+          try (InputStream inputStream = zipFile.getInputStream(entry);
+              FileOutputStream outputStream = new FileOutputStream(destPath); ) {
+            int data = inputStream.read();
+            while (data != -1) {
+              outputStream.write(data);
+              data = inputStream.read();
+            }
+          }
+          System.out.println("file : " + entry.getName() + " => " + destPath);
+        }
+      }
+    } catch (IOException e) {
+      throw new RuntimeException("Error unzipping file " + zipFilePath, e);
+    }
+  }
 }
