...
Code Block | ||
---|---|---|
| ||
static final int BUFFER = 512; // ... // external data source: filename BufferedOutputStream dest = null; FileInputStream fis = new FileInputStream(filename); ZipInputStream zis = new ZipInputStream(new BufferedInputStream(fis)); ZipEntry entry; while ((entry = zis.getNextEntry()) != null) { System.out.println("Extracting: " + entry); int count; byte data[] = new byte[BUFFER]; // write the files to the disk FileOutputStream fos = new FileOutputStream(entry.getName()); BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER); while ((count = zis.read(data, 0, BUFFER)) != -1) { dest.write(data, 0, count); } dest.flush(); dest.close(); zis.closeEntry(); } zis.close(); |
...
Code Block | ||
---|---|---|
| ||
static final int BUFFER = 512; static final int TOOBIG = 0x6400000; // 100MB // ... // external data source: filename FileInputStream fis = new FileInputStream(filename); ZipInputStream zis = new ZipInputStream(new BufferedInputStream(fis)); ZipEntry entry; try{ // ... while ((entry = zis.getNextEntry()) != null) { System.out.println("Extracting: " + entry); int count; byte data[] = new byte[BUFFER]; // write the files to the disk, but ensure that the file is not insanely big int total = 0; Â BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER); Â while (total <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { Â Â Â dest.write(data, 0, count); Â Â Â total += count; Â } Â dest.flush(); Â dest.close(); zis.closeEntry(); if (total > TOOBIG){ Â Â Â Â throw throw new IllegalStateException("File being unzipped is huge."); Â } Â // ... } } } finally { zis.close(); } |
Risk Assessment
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
IDS04-J | low | probable | high | P2 | L3 |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="044deb4d312049e5-5d89e268-4ecd4509-acc9914f-13fdad5f76dd5ab8f159f8bf"><ac:plain-text-body><![CDATA[ | [[Mahmoud 2002 | AA. References#Mahmoud 02]] | [Compressing and Decompressing Data Using Java APIs | http://java.sun.com/developer/technicalArticles/Programming/compression/] | ]]></ac:plain-text-body></ac:structured-macro> |
...