-
Notifications
You must be signed in to change notification settings - Fork 0
/
unzip.go
111 lines (96 loc) · 1.79 KB
/
unzip.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
package main
import (
"archive/zip"
"errors"
"io"
"os"
"path/filepath"
"strings"
"github.com/google/uuid"
tb "gopkg.in/tucnak/telebot.v2"
)
var (
errBadFile = errors.New("Bad file")
)
func unzip(f *tb.File, bot *tb.Bot) (string, error) {
id := uuid.NewString()
path := "tmp/" + id + ".zip"
dest := "tmp/" + id
err := bot.Download(f, path)
if err != nil {
return "", err
}
r, err := zip.OpenReader(path)
if err != nil {
return "", err
}
defer func() {
if err := r.Close(); err != nil {
panic(err)
}
}()
err = os.MkdirAll(dest, 0755)
if err != nil {
return "", err
}
// Check for zip bombs
var size uint64 = 0
for _, v := range r.File {
size += v.UncompressedSize64
}
if size > maxSize {
return "", errBadFile
}
err = os.MkdirAll(dest, 0755)
if err != nil {
return "", err
}
extractAndWriteFile := func(f *zip.File) error {
rc, err := f.Open()
if err != nil {
return err
}
defer func() {
if err := rc.Close(); err != nil {
panic(err)
}
}()
path := filepath.Join(dest, f.Name)
// Check for ZipSlip (Directory traversal)
if !strings.HasPrefix(path, filepath.Clean(dest)+string(os.PathSeparator)) {
return errBadFile
}
if f.FileInfo().IsDir() {
err = os.MkdirAll(path, f.Mode())
if err != nil {
return err
}
} else {
err = os.MkdirAll(filepath.Dir(path), f.Mode())
if err != nil {
return err
}
f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
if err != nil {
return err
}
defer func() {
if err := f.Close(); err != nil {
panic(err)
}
}()
_, err = io.Copy(f, rc)
if err != nil {
return err
}
}
return nil
}
for _, f := range r.File {
err := extractAndWriteFile(f)
if err != nil {
return "", err
}
}
return dest, nil
}