...
Furthermore, the code inside the while loop tracks the uncompressed file size of each entry in a zip archive while extracting the entry. It throws an exception if the entry being extracted is too large ���€š���‚�����‚�š����€š�? about 100MB in this case. We do not use the ZipEntry.getSize() method because the value it reports is not reliable.
| Code Block | ||
|---|---|---|
| ||
static final int BUFFER = 512;
static final int TOOBIG = 0x6400000; // 100MB
// ...
private String validateFilename(String filename, String intendedDir) {
File f = new File(filename);
String canonicalPath = f.getCanonicalPath();
File iD = new File(intendedDir);
String canonicalID = iD.getCanonicalPath();
if (canonicalPath.startsWith(canonicalID)) {
return canonicalPath;
} else {
throw new IllegalStateException("File is outside extraction target directory.");
}
}
public final void unzip(String filename) throws java.io.IOException{
FileInputStream fis = new FileInputStream(filename);
ZipInputStream zis = new ZipInputStream(new BufferedInputStream(fis));
ZipEntry entry;
try {
while ((entry = zis.getNextEntry()) != null) {
System.out.println("Extracting: " + entry);
int count;
byte data[] = new byte[BUFFER]; // write the files to the disk, but ensure that the file is not insanely big
int total = 0;
String name = validateFilename(entry.getName(), ".");
FileOutputStream fos = new FileOutputStream(name);
���‚�š ����€š�š BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
���‚�š ����€š�š while (total <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) {
���‚�š ���‚�š ���‚�š ����€š�š ����€š�š ����€š�š dest.write(data, 0, count);
���‚�š ���‚�š ���‚�š ����€š�š ����€š�š ����€š�š total += count;
���‚�š ����€š�š }
���‚�š ����€š�š dest.flush();
���‚�š ����€š�š dest.close();
zis.closeEntry();
if (total > TOOBIG) {
throw new IllegalStateException("File being unzipped is huge."); }
}
} finally {
zis.close();
}
}
|
...