...
Furthermore, the code inside the while loop tracks the uncompressed file size of each entry in a zip archive while extracting the entry. It throws an exception if the entry being extracted is too large ����������‚�š�š�š�š����������€š�š�š�š������������€š�š�š�š�š�����������‚�š�š�š�š�? about 100MB in this case. We do not use the ZipEntry.getSize() method because the value it reports is not reliable.
| Code Block | ||
|---|---|---|
| ||
static final int BUFFER = 512;
static final int TOOBIG = 0x6400000; // 100MB
// ...
private String validateFilename(String filename, String intendedDir) {
File f = new File(filename);
String canonicalPath = f.getCanonicalPath();
File iD = new File(intendedDir);
String canonicalID = iD.getCanonicalPath();
if (canonicalPath.startsWith(canonicalID)) {
return canonicalPath;
} else {
throw new IllegalStateException("File is outside extraction target directory.");
}
}
public final void unzip(String filename) throws java.io.IOException{
FileInputStream fis = new FileInputStream(filename);
ZipInputStream zis = new ZipInputStream(new BufferedInputStream(fis));
ZipEntry entry;
try {
while ((entry = zis.getNextEntry()) != null) {
System.out.println("Extracting: " + entry);
int count;
byte data[] = new byte[BUFFER]; // write the files to the disk, but ensure that the file is not insanely big
int total = 0;
String name = validateFilename(entry.getName(), ".");
FileOutputStream fos = new FileOutputStream(name);
����������€š�š�š�š�š �����������‚�š�š�š�š�š BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
����������€š�š�š�š�š �����������‚�š�š�š�š�š while (total <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) {
����������€š�š�š�š�š ����������€š�š�š�š�š ����������€š�š�š�š�š �����������‚�š�š�š�š�š �����������‚�š�š�š�š�š �����������‚�š�š�š�š�š dest.write(data, 0, count);
����������€š�š�š�š�š ����������€š�š�š�š�š ����������€š�š�š�š�š �����������‚�š�š�š�š�š �����������‚�š�š�š�š�š �����������‚�š�š�š�š�š total += count;
����������€š�š�š�š�š �����������‚�š�š�š�š�š }
����������€š�š�š�š�š �����������‚�š�š�š�š�š dest.flush();
����������€š�š�š�š�š �����������‚�š�š�š�š�š dest.close();
zis.closeEntry();
if (total > TOOBIG) {
throw new IllegalStateException("File being unzipped is huge."); }
}
} finally {
zis.close();
}
}
|
...