Package jadx.zip.security

Class JadxZipSecurity

java.lang.Object
jadx.zip.security.JadxZipSecurity
All Implemented Interfaces:
IJadxZipSecurity
public class JadxZipSecurity extends Object implements IJadxZipSecurity

  • Field Details

    • LOG

      private static final org.slf4j.Logger LOG

    • CWD

      private static final Path CWD

    • zipBombDetectionFactor

      private int zipBombDetectionFactor
      The size of uncompressed zip entry shouldn't be bigger of compressed in zipBombDetectionFactor times

    • zipBombMinUncompressedSize

      private int zipBombMinUncompressedSize
      Zip entries that have an uncompressed size of less than zipBombMinUncompressedSize are considered safe

    • maxEntriesCount

      private int maxEntriesCount

    • useLimitedDataStream

      private boolean useLimitedDataStream

  • Constructor Details

    • JadxZipSecurity

      public JadxZipSecurity()

  • Method Details

    • isValidEntry

      public boolean isValidEntry(IZipEntry entry)
      Description copied from interface: IJadxZipSecurity
      Check if zip entry is valid and safe to process
      Specified by:
      isValidEntry in interface IJadxZipSecurity

    • useLimitedDataStream

      public boolean useLimitedDataStream()
      Description copied from interface: IJadxZipSecurity
      Use limited InputStream for entry uncompressed data
      Specified by:
      useLimitedDataStream in interface IJadxZipSecurity

    • getMaxEntriesCount

      public int getMaxEntriesCount()
      Description copied from interface: IJadxZipSecurity
      Max entries count expected in a zip file, fail zip open if the limit exceeds. Return -1 to disable entries count check.
      Specified by:
      getMaxEntriesCount in interface IJadxZipSecurity

    • isValidEntryName

      public boolean isValidEntryName(String entryName)
      Checks that entry name contains no any traversals and prevents cases like "../classes.dex", to limit output only to the specified directory
      Specified by:
      isValidEntryName in interface IJadxZipSecurity

    • isInSubDirectory

      public boolean isInSubDirectory(File baseDir, File file)
      Description copied from interface: IJadxZipSecurity
      Check if a file will be inside baseDir after a system resolves its path
      Specified by:
      isInSubDirectory in interface IJadxZipSecurity

    • isZipBomb

      public boolean isZipBomb(IZipEntry entry)

    • isInSubDirectoryInternal

      private static boolean isInSubDirectoryInternal(File baseDir, File file)

    • setMaxEntriesCount

      public void setMaxEntriesCount(int maxEntriesCount)

    • setZipBombDetectionFactor

      public void setZipBombDetectionFactor(int zipBombDetectionFactor)

    • setZipBombMinUncompressedSize

      public void setZipBombMinUncompressedSize(int zipBombMinUncompressedSize)

    • setUseLimitedDataStream

      public void setUseLimitedDataStream(boolean useLimitedDataStream)