TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Core\Service\Archive;
+
+use TYPO3\CMS\Core\Exception\Archive\ExtractException;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+/**
+ * Service that handles zip creation and extraction
+ *
+ * @internal
+ */
+readonly class ZipService
+{
+    /**
+     * Extracts the zip archive to a given directory. This method makes sure a file cannot be placed outside the directory.
+     *
+     * @throws ExtractException
+     */
+    public function extract(string $fileName, string $directory): bool
+    {
+        $this->assertDirectoryIsWritable($directory);
+
+        $zip = new \ZipArchive();
+        $state = $zip->open($fileName);
+        if ($state !== true) {
+            throw new ExtractException(
+                sprintf('Unable to open zip file %s, error code %d', $fileName, $state),
+                1565709712
+            );
+        }
+
+        $result = $zip->extractTo($directory);
+        $zip->close();
+        if ($result) {
+            GeneralUtility::fixPermissions(rtrim($directory, '/'), true);
+        }
+        return $result;
+    }
+
+    /**
+     * @throws ExtractException
+     */
+    public function verify(string $fileName): bool
+    {
+        $zip = new \ZipArchive();
+        $state = $zip->open($fileName);
+        if ($state !== true) {
+            throw new ExtractException(
+                sprintf('Unable to open zip file %s, error code %d', $fileName, $state),
+                1565709713
+            );
+        }
+
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $entryName = str_replace('\\', '/', (string)$zip->getNameIndex($i));
+            if (preg_match('#/(?:\.{2,})+#', $entryName) // Contains any traversal sequence starting with a slash, e.g. /../, /.., /.../
+                || preg_match('#^(?:\.{2,})+/#', $entryName) // Starts with a traversal sequence, e.g. ../, .../
+            ) {
+                throw new ExtractException(
+                    sprintf('Suspicious sequence in zip file %s: %s', $fileName, $entryName),
+                    1565709714
+                );
+            }
+        }
+
+        $zip->close();
+        return true;
+    }
+
+    private function assertDirectoryIsWritable(string $directory): void
+    {
+        if (!is_dir($directory)) {
+            throw new \RuntimeException(
+                sprintf('Directory %s does not exist', $directory),
+                1565773005
+            );
+        }
+        if (!is_writable($directory)) {
+            throw new \RuntimeException(
+                sprintf('Directory %s is not writable', $directory),
+                1565773006
+            );
+        }
+    }
+}