| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "third_party/zlib/google/zip_reader.h" | 5 #include "third_party/zlib/google/zip_reader.h" |
| 6 | 6 |
| 7 #include "base/file_util.h" | 7 #include "base/file_util.h" |
| 8 #include "base/logging.h" | 8 #include "base/logging.h" |
| 9 #include "base/strings/string_util.h" | 9 #include "base/strings/string_util.h" |
| 10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
| (...skipping 21 matching lines...) Expand all Loading... |
| 32 original_size_ = raw_file_info.uncompressed_size; | 32 original_size_ = raw_file_info.uncompressed_size; |
| 33 | 33 |
| 34 // Directory entries in zip files end with "/". | 34 // Directory entries in zip files end with "/". |
| 35 is_directory_ = EndsWith(file_name_in_zip, "/", false); | 35 is_directory_ = EndsWith(file_name_in_zip, "/", false); |
| 36 | 36 |
| 37 // Check the file name here for directory traversal issues. In the name of | 37 // Check the file name here for directory traversal issues. In the name of |
| 38 // simplicity and security, we might reject a valid file name such as "a..b". | 38 // simplicity and security, we might reject a valid file name such as "a..b". |
| 39 is_unsafe_ = file_name_in_zip.find("..") != std::string::npos; | 39 is_unsafe_ = file_name_in_zip.find("..") != std::string::npos; |
| 40 | 40 |
| 41 // We also consider that the file name is unsafe, if it's invalid UTF-8. | 41 // We also consider that the file name is unsafe, if it's invalid UTF-8. |
| 42 string16 file_name_utf16; | 42 base::string16 file_name_utf16; |
| 43 if (!UTF8ToUTF16(file_name_in_zip.data(), file_name_in_zip.size(), | 43 if (!UTF8ToUTF16(file_name_in_zip.data(), file_name_in_zip.size(), |
| 44 &file_name_utf16)) { | 44 &file_name_utf16)) { |
| 45 is_unsafe_ = true; | 45 is_unsafe_ = true; |
| 46 } | 46 } |
| 47 | 47 |
| 48 // We also consider that the file name is unsafe, if it's absolute. | 48 // We also consider that the file name is unsafe, if it's absolute. |
| 49 // On Windows, IsAbsolute() returns false for paths starting with "/". | 49 // On Windows, IsAbsolute() returns false for paths starting with "/". |
| 50 if (file_path_.IsAbsolute() || StartsWithASCII(file_name_in_zip, "/", false)) | 50 if (file_path_.IsAbsolute() || StartsWithASCII(file_name_in_zip, "/", false)) |
| 51 is_unsafe_ = true; | 51 is_unsafe_ = true; |
| 52 | 52 |
| (...skipping 248 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 301 } | 301 } |
| 302 | 302 |
| 303 void ZipReader::Reset() { | 303 void ZipReader::Reset() { |
| 304 zip_file_ = NULL; | 304 zip_file_ = NULL; |
| 305 num_entries_ = 0; | 305 num_entries_ = 0; |
| 306 reached_end_ = false; | 306 reached_end_ = false; |
| 307 current_entry_info_.reset(); | 307 current_entry_info_.reset(); |
| 308 } | 308 } |
| 309 | 309 |
| 310 } // namespace zip | 310 } // namespace zip |
| OLD | NEW |