Skip to content
This repository has been archived by the owner on Nov 9, 2020. It is now read-only.

Commit

Permalink
⚡ Zip: don't trust "getSize"
Browse files Browse the repository at this point in the history
This method may return "-1", or wrong values. Relying on it is
dangerous.
+ add a TODO item: limit the max file size? We don't want to hold more
than X MB in memory, do we?
  • Loading branch information
punkeel committed Apr 23, 2017
1 parent f68ff28 commit e0674a7
Showing 1 changed file with 5 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -73,15 +73,17 @@ private void sanitizeFile(BleachSession session, ZipInputStream zipIn, ZipOutput
ByteArrayOutputStream streamBuilder = new ByteArrayOutputStream();

int bytesRead;
byte[] tempBuffer = new byte[(int) entry.getSize()];
// @TODO: check real file size?
byte[] tempBuffer = new byte[1024];
while ((bytesRead = zipIn.read(tempBuffer)) != -1) {
streamBuilder.write(tempBuffer, 0, bytesRead);
}
ByteArrayOutputStream out = new ByteArrayOutputStream();

ByteArrayInputStream bais = new ByteArrayInputStream(streamBuilder.toByteArray());
CloseShieldInputStream is = new CloseShieldInputStream(new BufferedInputStream(bais));

ByteArrayOutputStream out = new ByteArrayOutputStream();


try {
session.sanitize(is, out);
} catch (RecursionBleachException e) {
Expand Down

0 comments on commit e0674a7

Please sign in to comment.