Class SecureZipExtractor

java.lang.Object

ghidra.util.SecureZipExtractor

public class SecureZipExtractor
extends Object

A utility class to safely extract zip files.

Protects against:

• Zip Slip
• Zip Bomb

Constructor Summary

Constructors

Constructor	Description
SecureZipExtractor()

Method Summary

Modifier and Type	Method	Description
static void	extractSecurely(File zipFile, File targetDir, int maxFiles, TaskMonitor monitor)	Securely extracts the given zip file to the given directory
static void	extractSecurely(org.apache.commons.compress.archivers.zip.ZipFile archive, org.apache.commons.compress.archivers.zip.ZipArchiveEntry entry, File outputFile)	Securely writes the given zip entry to the given output file.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecureZipExtractor

public SecureZipExtractor()

Method Details

extractSecurely

public static void extractSecurely(File zipFile,
 File targetDir,
 int maxFiles,
 TaskMonitor monitor)
                            throws IOException,
CancelledException

Securely extracts the given zip file to the given directory

Parameters:

zipFile - The zip File to extract

targetDir - The directory to unzip to

maxFiles - The maximum number of files that will be unzipped before an IOException is thrown

monitor - A cancellable TaskMonitor

Throws:

IOException - if a zip slip, zip bomb, or other IO-related error occurred

CancelledException - if the operation was cancelled

extractSecurely

public static void extractSecurely(org.apache.commons.compress.archivers.zip.ZipFile archive,
 org.apache.commons.compress.archivers.zip.ZipArchiveEntry entry,
 File outputFile)
                            throws IOException

Securely writes the given zip entry to the given output file. Assumes that the output file's directory exists.

Parameters:

archive - The original ZipFile to extract from

entry - The entry to extract

outputFile - The File to extract the entry to

Throws:

IOException - if a zip bomb or other IO-related error occurred