hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

update tests, is not completed yet :)

Browse Source
This commit is contained in:
am0o0
2024-07-01 18:22:27 +02:00
parent a6833945c1
commit 7df59ffe6c
11 changed files with 65 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/Zip4jHandler.java Normal file
View File

@@ -0,0 +1,43 @@
import net.lingala.zip4j.model.LocalFileHeader;
import net.lingala.zip4j.io.inputstream.ZipInputStream;
import java.io.*;
public class Zip4jHandler {
public static void zip4jZipInputStream(InputStream inputStream) throws IOException {
LocalFileHeader localFileHeader;
int readLen;
byte[] readBuffer = new byte[4096];
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) {
while ((localFileHeader = zipInputStream.getNextEntry()) != null) {
File extractedFile = new File(localFileHeader.getFileName());
try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
while ((readLen = zipInputStream.read(readBuffer)) != -1) {
outputStream.write(readBuffer, 0, readLen);
}
}
}
}
}
public static void zip4jZipInputStreamSafe(InputStream inputStream) throws IOException {
LocalFileHeader localFileHeader;
int readLen;
byte[] readBuffer = new byte[4096];
try (ZipInputStream zipInputStream = new ZipInputStream(inputStream)) {
while ((localFileHeader = zipInputStream.getNextEntry()) != null) {
File extractedFile = new File(localFileHeader.getFileName());
try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
int totallRead = 0;
while ((readLen = zipInputStream.read(readBuffer)) != -1) {
totallRead += readLen;
if (totallRead > 1024 * 1024 * 4) {
System.out.println("potential Bomb");
break;
}
outputStream.write(readBuffer, 0, readLen);
}
}
}
}
}
}