102 lines
3.0 KiB
PHP
102 lines
3.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the TYPO3 CMS project.
|
|
*
|
|
* It is free software; you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License, either version 2
|
|
* of the License, or any later version.
|
|
*
|
|
* For the full copyright and license information, please read the
|
|
* LICENSE.txt file that was distributed with this source code.
|
|
*
|
|
* The TYPO3 project - inspiring people to share!
|
|
*/
|
|
|
|
namespace TYPO3\CMS\Core\Service\Archive;
|
|
|
|
use TYPO3\CMS\Core\Exception\Archive\ExtractException;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
|
|
/**
|
|
* Service that handles zip creation and extraction
|
|
*
|
|
* @internal
|
|
*/
|
|
readonly class ZipService
|
|
{
|
|
/**
|
|
* Extracts the zip archive to a given directory. This method makes sure a file cannot be placed outside the directory.
|
|
*
|
|
* @throws ExtractException
|
|
*/
|
|
public function extract(string $fileName, string $directory): bool
|
|
{
|
|
$this->assertDirectoryIsWritable($directory);
|
|
|
|
$zip = new \ZipArchive();
|
|
$state = $zip->open($fileName);
|
|
if ($state !== true) {
|
|
throw new ExtractException(
|
|
sprintf('Unable to open zip file %s, error code %d', $fileName, $state),
|
|
1565709712
|
|
);
|
|
}
|
|
|
|
$result = $zip->extractTo($directory);
|
|
$zip->close();
|
|
if ($result) {
|
|
GeneralUtility::fixPermissions(rtrim($directory, '/'), true);
|
|
}
|
|
return $result;
|
|
}
|
|
|
|
/**
|
|
* @throws ExtractException
|
|
*/
|
|
public function verify(string $fileName): bool
|
|
{
|
|
$zip = new \ZipArchive();
|
|
$state = $zip->open($fileName);
|
|
if ($state !== true) {
|
|
throw new ExtractException(
|
|
sprintf('Unable to open zip file %s, error code %d', $fileName, $state),
|
|
1565709713
|
|
);
|
|
}
|
|
|
|
for ($i = 0; $i < $zip->numFiles; $i++) {
|
|
$entryName = str_replace('\\', '/', (string)$zip->getNameIndex($i));
|
|
if (preg_match('#/(?:\.{2,})+#', $entryName) // Contains any traversal sequence starting with a slash, e.g. /../, /.., /.../
|
|
|| preg_match('#^(?:\.{2,})+/#', $entryName) // Starts with a traversal sequence, e.g. ../, .../
|
|
) {
|
|
throw new ExtractException(
|
|
sprintf('Suspicious sequence in zip file %s: %s', $fileName, $entryName),
|
|
1565709714
|
|
);
|
|
}
|
|
}
|
|
|
|
$zip->close();
|
|
return true;
|
|
}
|
|
|
|
private function assertDirectoryIsWritable(string $directory): void
|
|
{
|
|
if (!is_dir($directory)) {
|
|
throw new \RuntimeException(
|
|
sprintf('Directory %s does not exist', $directory),
|
|
1565773005
|
|
);
|
|
}
|
|
if (!is_writable($directory)) {
|
|
throw new \RuntimeException(
|
|
sprintf('Directory %s is not writable', $directory),
|
|
1565773006
|
|
);
|
|
}
|
|
}
|
|
}
|