Package de.hybris.platform.util.zip

Class SafeZipInputStream

java.lang.Object

java.io.InputStream

java.io.FilterInputStream

java.util.zip.InflaterInputStream

java.util.zip.ZipInputStream

de.hybris.platform.util.zip.SafeZipInputStream

All Implemented Interfaces:

java.io.Closeable, java.lang.AutoCloseable

public class SafeZipInputStream
extends java.util.zip.ZipInputStream

SafeZipInputStream extends ZipInputStream and replaces ZipEntry with SafeZipEntry that mitigates Zip slip vulnerability.

Field Summary

Fields

Modifier and Type	Field	Description
static int	CENATT
static int	CENATX
static int	CENCOM
static int	CENCRC
static int	CENDSK
static int	CENEXT
static int	CENFLG
static int	CENHDR
static int	CENHOW
static int	CENLEN
static int	CENNAM
static int	CENOFF
static long	CENSIG
static int	CENSIZ
static int	CENTIM
static int	CENVEM
static int	CENVER
static int	ENDCOM
static int	ENDHDR
static int	ENDOFF
static long	ENDSIG
static int	ENDSIZ
static int	ENDSUB
static int	ENDTOT
static int	EXTCRC
static int	EXTHDR
static int	EXTLEN
static long	EXTSIG
static int	EXTSIZ
static int	LOCCRC
static int	LOCEXT
static int	LOCFLG
static int	LOCHDR
static int	LOCHOW
static int	LOCLEN
static int	LOCNAM
static long	LOCSIG
static int	LOCSIZ
static int	LOCTIM
static int	LOCVER

Fields inherited from class java.util.zip.InflaterInputStream

buf, inf, len

Fields inherited from class java.io.FilterInputStream

in

Constructor Summary

Constructors

Constructor	Description
SafeZipInputStream(java.io.InputStream in)
SafeZipInputStream(java.io.InputStream in, java.nio.charset.Charset charset)

Method Summary

Modifier and Type	Method	Description
protected SafeZipEntry	createZipEntry(java.lang.String name)	Creates a new SafeZipEntry object for the specified entry name.
SafeZipEntry	getNextEntry()	Reads the next ZIP safe file entry that mitigates Zip slip vulnerability

Methods inherited from class java.util.zip.ZipInputStream

available, close, closeEntry, read, skip

Methods inherited from class java.util.zip.InflaterInputStream

fill, mark, markSupported, read, reset

Methods inherited from class java.io.FilterInputStream

read

Methods inherited from class java.io.InputStream

nullInputStream, readAllBytes, readNBytes, readNBytes, transferTo

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOCSIG

public static final long LOCSIG

See Also:

Constant Field Values

EXTSIG

public static final long EXTSIG

See Also:

Constant Field Values

CENSIG

public static final long CENSIG

See Also:

Constant Field Values

ENDSIG

public static final long ENDSIG

See Also:

Constant Field Values

LOCHDR

public static final int LOCHDR

See Also:

Constant Field Values

EXTHDR

public static final int EXTHDR

See Also:

Constant Field Values

CENHDR

public static final int CENHDR

See Also:

Constant Field Values

ENDHDR

public static final int ENDHDR

See Also:

Constant Field Values

LOCVER

public static final int LOCVER

See Also:

Constant Field Values

LOCFLG

public static final int LOCFLG

See Also:

Constant Field Values

LOCHOW

public static final int LOCHOW

See Also:

Constant Field Values

LOCTIM

public static final int LOCTIM

See Also:

Constant Field Values

LOCCRC

public static final int LOCCRC

See Also:

Constant Field Values

LOCSIZ

public static final int LOCSIZ

See Also:

Constant Field Values

LOCLEN

public static final int LOCLEN

See Also:

Constant Field Values

LOCNAM

public static final int LOCNAM

See Also:

Constant Field Values

LOCEXT

public static final int LOCEXT

See Also:

Constant Field Values

EXTCRC

public static final int EXTCRC

See Also:

Constant Field Values

EXTSIZ

public static final int EXTSIZ

See Also:

Constant Field Values

EXTLEN

public static final int EXTLEN

See Also:

Constant Field Values

CENVEM

public static final int CENVEM

See Also:

Constant Field Values

CENVER

public static final int CENVER

See Also:

Constant Field Values

CENFLG

public static final int CENFLG

See Also:

Constant Field Values

CENHOW

public static final int CENHOW

See Also:

Constant Field Values

CENTIM

public static final int CENTIM

See Also:

Constant Field Values

CENCRC

public static final int CENCRC

See Also:

Constant Field Values

CENSIZ

public static final int CENSIZ

See Also:

Constant Field Values

CENLEN

public static final int CENLEN

See Also:

Constant Field Values

CENNAM

public static final int CENNAM

See Also:

Constant Field Values

CENEXT

public static final int CENEXT

See Also:

Constant Field Values

CENCOM

public static final int CENCOM

See Also:

Constant Field Values

CENDSK

public static final int CENDSK

See Also:

Constant Field Values

CENATT

public static final int CENATT

See Also:

Constant Field Values

CENATX

public static final int CENATX

See Also:

Constant Field Values

CENOFF

public static final int CENOFF

See Also:

Constant Field Values

ENDSUB

public static final int ENDSUB

See Also:

Constant Field Values

ENDTOT

public static final int ENDTOT

See Also:

Constant Field Values

ENDSIZ

public static final int ENDSIZ

See Also:

Constant Field Values

ENDOFF

public static final int ENDOFF

See Also:

Constant Field Values

ENDCOM

public static final int ENDCOM

See Also:

Constant Field Values

Constructor Detail

SafeZipInputStream

public SafeZipInputStream(java.io.InputStream in)

SafeZipInputStream

public SafeZipInputStream(java.io.InputStream in,
                          java.nio.charset.Charset charset)

Method Detail

getNextEntry

public SafeZipEntry getNextEntry()
                          throws java.io.IOException

Reads the next ZIP safe file entry that mitigates Zip slip vulnerability

Overrides:

getNextEntry in class java.util.zip.ZipInputStream

Returns:

the next safe ZIP file entry, or null if there are no more entries

Throws:

java.io.IOException

createZipEntry

protected SafeZipEntry createZipEntry(java.lang.String name)

Creates a new SafeZipEntry object for the specified entry name.

Overrides:

createZipEntry in class java.util.zip.ZipInputStream

Parameters:

name - the ZIP file entry name

Returns:

the SafeZipEntry just created