Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in
Toggle navigation
J
jadx
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
open-source
jadx
Commits
c4765939
Commit
c4765939
authored
Jan 14, 2018
by
Sergey Toshin
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Changes MAX_SIZE_DIFF in ZipSecurity, and adds extra logging
parent
089467a4
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
3 additions
and
1 deletion
+3
-1
ZipSecurity.java
...core/src/main/java/jadx/core/utils/files/ZipSecurity.java
+3
-1
No files found.
jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
View file @
c4765939
...
...
@@ -10,7 +10,7 @@ public class ZipSecurity {
private
static
final
Logger
LOG
=
LoggerFactory
.
getLogger
(
ZipSecurity
.
class
);
// size of uncompressed zip entry shouldn't be bigger of compressed in MAX_SIZE_DIFF times
private
static
final
int
MAX_SIZE_DIFF
=
10
;
private
static
final
int
MAX_SIZE_DIFF
=
25
;
private
static
boolean
isInSubDirectory
(
File
base
,
File
file
)
{
if
(
file
==
null
)
{
...
...
@@ -45,6 +45,8 @@ public class ZipSecurity {
long
compressedSize
=
entry
.
getCompressedSize
();
long
uncompressedSize
=
entry
.
getSize
();
if
(
compressedSize
<
0
||
uncompressedSize
<
0
)
{
LOG
.
error
(
"Zip bomp attack detected, invalid sizes: compressed {}, uncompressed {}, name {}"
,
compressedSize
,
uncompressedSize
,
entry
.
getName
());
return
true
;
}
if
(
compressedSize
*
MAX_SIZE_DIFF
<
uncompressedSize
)
{
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment