Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
Quincy379
jadx
提交
528ca09e
J
jadx
项目概览
Quincy379
/
jadx
与 Fork 源项目一致
从无法访问的项目Fork
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jadx
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
528ca09e
编写于
12月 31, 2017
作者:
S
Sergey Toshin
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Fixes for ZIP and XML processors
上级
a9ae9716
变更
8
隐藏空白更改
内联
并排
Showing
8 changed file
with
91 addition
and
4 deletion
+91
-4
.DS_Store
.DS_Store
+0
-0
jadx-core/.DS_Store
jadx-core/.DS_Store
+0
-0
jadx-core/src/main/java/jadx/api/ResourcesLoader.java
jadx-core/src/main/java/jadx/api/ResourcesLoader.java
+8
-1
jadx-core/src/main/java/jadx/core/clsp/ClsSet.java
jadx-core/src/main/java/jadx/core/clsp/ClsSet.java
+2
-1
jadx-core/src/main/java/jadx/core/utils/files/InputFile.java
jadx-core/src/main/java/jadx/core/utils/files/InputFile.java
+7
-0
jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
...core/src/main/java/jadx/core/utils/files/ZipSecurity.java
+47
-0
jadx-core/src/main/java/jadx/core/xmlgen/ManifestAttributes.java
...re/src/main/java/jadx/core/xmlgen/ManifestAttributes.java
+1
-2
jadx-core/src/main/java/jadx/core/xmlgen/XmlSecurity.java
jadx-core/src/main/java/jadx/core/xmlgen/XmlSecurity.java
+26
-0
未找到文件。
.DS_Store
0 → 100644
浏览文件 @
528ca09e
文件已添加
jadx-core/.DS_Store
0 → 100644
浏览文件 @
528ca09e
文件已添加
jadx-core/src/main/java/jadx/api/ResourcesLoader.java
浏览文件 @
528ca09e
...
...
@@ -5,6 +5,7 @@ import jadx.core.codegen.CodeWriter;
import
jadx.core.utils.Utils
;
import
jadx.core.utils.exceptions.JadxException
;
import
jadx.core.utils.files.InputFile
;
import
jadx.core.utils.files.ZipSecurity
;
import
jadx.core.xmlgen.ResContainer
;
import
jadx.core.xmlgen.ResTableParser
;
...
...
@@ -64,6 +65,10 @@ public final class ResourcesLoader {
if
(
entry
==
null
)
{
throw
new
IOException
(
"Zip entry not found: "
+
zipRef
);
}
if
(!
ZipSecurity
.
isValidZipEntry
(
entry
))
{
return
null
;
}
inputStream
=
new
BufferedInputStream
(
zipFile
.
getInputStream
(
entry
));
result
=
decoder
.
decode
(
entry
.
getSize
(),
inputStream
);
}
catch
(
Exception
e
)
{
...
...
@@ -129,7 +134,9 @@ public final class ResourcesLoader {
Enumeration
<?
extends
ZipEntry
>
entries
=
zip
.
entries
();
while
(
entries
.
hasMoreElements
())
{
ZipEntry
entry
=
entries
.
nextElement
();
addEntry
(
list
,
file
,
entry
);
if
(
ZipSecurity
.
isValidZipEntry
(
entry
))
{
addEntry
(
list
,
file
,
entry
);
}
}
}
catch
(
IOException
e
)
{
LOG
.
debug
(
"Not a zip file: {}"
,
file
.
getAbsolutePath
());
...
...
jadx-core/src/main/java/jadx/core/clsp/ClsSet.java
浏览文件 @
528ca09e
...
...
@@ -6,6 +6,7 @@ import jadx.core.dex.nodes.RootNode;
import
jadx.core.utils.exceptions.DecodeException
;
import
jadx.core.utils.exceptions.JadxRuntimeException
;
import
jadx.core.utils.files.FileUtils
;
import
jadx.core.utils.files.ZipSecurity
;
import
java.io.BufferedOutputStream
;
import
java.io.DataInputStream
;
...
...
@@ -173,7 +174,7 @@ public class ClsSet {
try
{
ZipEntry
entry
=
in
.
getNextEntry
();
while
(
entry
!=
null
)
{
if
(
entry
.
getName
().
endsWith
(
CLST_EXTENSION
))
{
if
(
entry
.
getName
().
endsWith
(
CLST_EXTENSION
)
&&
ZipSecurity
.
isValidZipEntry
(
entry
)
)
{
load
(
in
);
}
entry
=
in
.
getNextEntry
();
...
...
jadx-core/src/main/java/jadx/core/utils/files/InputFile.java
浏览文件 @
528ca09e
...
...
@@ -88,6 +88,13 @@ public class InputFile {
if
(
entry
==
null
)
{
break
;
}
// security check
if
(!
ZipSecurity
.
isValidZipEntry
(
entry
))
{
index
++;
continue
;
}
InputStream
inputStream
=
zf
.
getInputStream
(
entry
);
try
{
if
(
ext
.
equals
(
".dex"
))
{
...
...
jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
0 → 100644
浏览文件 @
528ca09e
package
jadx.core.utils.files
;
import
java.io.File
;
import
java.util.zip.ZipEntry
;
public
class
ZipSecurity
{
// size of uncompressed zip entry shouldn't be bigger of compressed in MAX_SIZE_DIFF times
private
static
final
int
MAX_SIZE_DIFF
=
5
;
private
static
boolean
isInSubDirectory
(
File
base
,
File
file
)
{
if
(
file
==
null
)
{
return
false
;
}
if
(
file
.
equals
(
base
))
{
return
true
;
}
return
isInSubDirectory
(
base
,
file
.
getParentFile
());
}
// checks that entry name contains no any traversals
// and prevents cases like "../classes.dex", to limit output only to the specified directory
public
static
boolean
isValidZipEntryName
(
String
entryName
)
{
try
{
File
currentPath
=
new
File
(
"."
).
getCanonicalFile
();
File
canonical
=
new
File
(
currentPath
,
entryName
).
getCanonicalFile
();
return
isInSubDirectory
(
currentPath
,
canonical
);
}
catch
(
Exception
e
)
{
return
false
;
}
}
public
static
boolean
isZipBomb
(
ZipEntry
entry
)
{
long
compressedSize
=
entry
.
getCompressedSize
();
long
uncompressedSize
=
entry
.
getSize
();
if
(
compressedSize
<
0
||
uncompressedSize
<
0
)
{
return
true
;
}
return
compressedSize
*
MAX_SIZE_DIFF
<
uncompressedSize
;
}
public
static
boolean
isValidZipEntry
(
ZipEntry
entry
)
{
return
isValidZipEntryName
(
entry
.
getName
())
&&
!
isZipBomb
(
entry
);
}
}
jadx-core/src/main/java/jadx/core/xmlgen/ManifestAttributes.java
浏览文件 @
528ca09e
...
...
@@ -3,7 +3,6 @@ package jadx.core.xmlgen;
import
jadx.core.utils.exceptions.JadxException
;
import
javax.xml.parsers.DocumentBuilder
;
import
javax.xml.parsers.DocumentBuilderFactory
;
import
javax.xml.parsers.ParserConfigurationException
;
import
java.io.IOException
;
import
java.io.InputStream
;
...
...
@@ -72,7 +71,7 @@ public class ManifestAttributes {
if
(
xmlStream
==
null
)
{
throw
new
JadxException
(
xml
+
" not found in classpath"
);
}
DocumentBuilder
dBuilder
=
DocumentBuilderFactory
.
newInstance
().
newDocumentBuilder
();
DocumentBuilder
dBuilder
=
XmlSecurity
.
getSecureDbf
().
newDocumentBuilder
();
doc
=
dBuilder
.
parse
(
xmlStream
);
}
finally
{
close
(
xmlStream
);
...
...
jadx-core/src/main/java/jadx/core/xmlgen/XmlSecurity.java
0 → 100644
浏览文件 @
528ca09e
package
jadx.core.xmlgen
;
import
javax.xml.parsers.DocumentBuilderFactory
;
import
javax.xml.parsers.ParserConfigurationException
;
public
class
XmlSecurity
{
private
static
DocumentBuilderFactory
secureDbf
=
null
;
public
static
DocumentBuilderFactory
getSecureDbf
()
throws
ParserConfigurationException
{
synchronized
(
XmlSecurity
.
class
)
{
if
(
secureDbf
==
null
)
{
secureDbf
=
DocumentBuilderFactory
.
newInstance
();
secureDbf
.
setFeature
(
"http://apache.org/xml/features/disallow-doctype-decl"
,
true
);
secureDbf
.
setFeature
(
"http://apache.org/xml/features/nonvalidating/load-external-dtd"
,
false
);
secureDbf
.
setFeature
(
"http://xml.org/sax/features/external-general-entities"
,
false
);
secureDbf
.
setFeature
(
"http://xml.org/sax/features/external-parameter-entities"
,
false
);
secureDbf
.
setFeature
(
"http://apache.org/xml/features/dom/create-entity-ref-nodes"
,
false
);
secureDbf
.
setXIncludeAware
(
false
);
secureDbf
.
setExpandEntityReferences
(
false
);
}
}
return
secureDbf
;
}
}
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录