[K/N][test] Move ZipTest to compiler/util-io tests

This is the last test in the Klib and was run separately. Instead, it should be located with 'kotlin-util-io' project which it tests Merge-request: KT-MR-13978 Merged-by: Pavel Punegov <Pavel.Punegov@jetbrains.com>
2024-01-23 11:01:58 +00:00
parent 3dd4a0d868
commit cdb6a06e49
2 changed files with 3 additions and 12 deletions
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2010-2024 JetBrains s.r.o. and Kotlin Programming Language contributors.
+ * Use of this source code is governed by the Apache 2.0 license that can be found in the license/LICENSE.txt file.
+ */
+
+package org.jetbrains.kotlin.cli.klib
+
+import org.jetbrains.kotlin.konan.file.File
+import org.jetbrains.kotlin.konan.file.unzipTo
+import org.jetbrains.kotlin.konan.file.use
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TestName
+import java.io.FileOutputStream
+import java.io.IOException
+import java.util.zip.ZipEntry
+import java.util.zip.ZipException
+import java.util.zip.ZipOutputStream
+import kotlin.test.assertFailsWith
+
+class ZipTest {
+
+    @Rule
+    @JvmField
+    val currentTestName = TestName()
+
+    private lateinit var tmpDir: File
+
+    @Before
+    fun setUp() {
+        tmpDir = org.jetbrains.kotlin.konan.file.createTempDir(currentTestName.methodName)
+        tmpDir.deleteOnExitRecursively()
+    }
+
+    @Test
+    fun testZipSlip() {
+        // https://security.snyk.io/research/zip-slip-vulnerability
+        val zipArchive = tmpDir.child("sneaky.klib")
+
+        createMaliciousArchive(zipArchive)
+
+        try {
+            zipArchive.unzipTo(tmpDir.child("unpacked"))
+        } catch (e: Exception) {
+            if (e !is IOException && e.cause !is IOException) throw e
+        }
+
+        assert(!tmpDir.child("definitelySafe.txt").exists) { "ZipSlip vulnerability found!" }
+    }
+
+    @Test
+    fun testZipSlipValidation() {
+        val zipArchive = tmpDir.child("sneaky.klib")
+
+        createMaliciousArchive(zipArchive)
+
+        assertFailsWith<ZipException> {
+            zipArchive.unzipTo(tmpDir.child("unpacked"))
+        }
+    }
+}
+
+private fun createMaliciousArchive(file: File) {
+    ZipOutputStream(FileOutputStream(java.io.File(file.path))).use {
+        it.putNextEntry(ZipEntry("../definitelySafe.txt"))
+        it.closeEntry()
+    }
+}