hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

update tests

Browse Source
This commit is contained in:
amammad
2023-10-14 12:28:58 +02:00
parent e34cc42441
commit 59fb479895
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/HelloServlet.java
View File

@@ -10,6 +10,8 @@ import static com.Bombs.ZipHandler.*;
import java.io.*;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.zip.DataFormatException;
import javax.servlet.ServletException;
import javax.servlet.annotation.MultipartConfig;
import javax.servlet.annotation.WebServlet;
@@ -36,6 +38,16 @@ public class HelloServlet extends HttpServlet {
ZipInputStreamUnsafe(remoteFile.getInputStream());
GZipInputStreamUnsafe(request.getPart("zipFile").getInputStream());
InflaterInputStreamUnsafe(request.getPart("zipFile").getInputStream());
try {
InflaterUnsafe(request.getParameter("data").getBytes(StandardCharsets.UTF_8));
} catch (DataFormatException e) {
throw new RuntimeException(e);
}
try {
ZipFile1(request.getParameter("zipFileName"));
} catch (DataFormatException e) {
throw new RuntimeException(e);
}
// Zip4j
zip4jZipInputStream(remoteFile.getInputStream());

48
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/src/main/java/com/Bombs/ZipHandler.java
View File

@@ -2,7 +2,10 @@ package com.Bombs;
import java.io.*;
import java.io.FileOutputStream;
import java.nio.ByteBuffer;
import java.util.Enumeration;
import java.util.zip.*;
import java.util.zip.ZipFile;
public class ZipHandler {
public static void ZipInputStreamSafe(InputStream inputStream) throws IOException {
@@ -127,4 +130,49 @@ public class ZipHandler {
dest.close();
}
}
public static void InflaterUnsafe(byte[] inputBytes) throws DataFormatException, IOException {
Inflater inflater = new Inflater();
inflater.setInput(inputBytes);
try (final ByteArrayOutputStream outputStream = new ByteArrayOutputStream(inputBytes.length)) {
byte[] buffer = new byte[1024];
while (!inflater.finished()) {
final int count = inflater.inflate(buffer);
outputStream.write(buffer, 0, count);
}
outputStream.toByteArray();
}
}
public static void ZipFile1(String zipFilePath) throws DataFormatException, IOException {
try {
System.out.println("zipFilePath = " + zipFilePath);
ZipFile zipFile = new ZipFile(zipFilePath);
Enumeration<? extends ZipEntry> entries = zipFile.entries();
while (entries.hasMoreElements()) {
ZipEntry entry = entries.nextElement();
if (entry.isDirectory()) {
System.out.print("dir : " + entry.getName());
String destPath = "tmp" + File.separator + entry.getName();
System.out.println(" => " + destPath);
File file = new File(destPath);
file.mkdirs();
} else {
String destPath = "tmp" + File.separator + entry.getName();
try (InputStream inputStream = zipFile.getInputStream(entry);
FileOutputStream outputStream = new FileOutputStream(destPath); ) {
int data = inputStream.read();
while (data != -1) {
outputStream.write(data);
data = inputStream.read();
}
}
System.out.println("file : " + entry.getName() + " => " + destPath);
}
}
} catch (IOException e) {
throw new RuntimeException("Error unzipping file " + zipFilePath, e);
}
}
}