index.js 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796
  1. var fs = require("fs");
  2. var zlib = require("zlib");
  3. var fd_slicer = require("fd-slicer");
  4. var crc32 = require("buffer-crc32");
  5. var util = require("util");
  6. var EventEmitter = require("events").EventEmitter;
  7. var Transform = require("stream").Transform;
  8. var PassThrough = require("stream").PassThrough;
  9. var Writable = require("stream").Writable;
  10. exports.open = open;
  11. exports.fromFd = fromFd;
  12. exports.fromBuffer = fromBuffer;
  13. exports.fromRandomAccessReader = fromRandomAccessReader;
  14. exports.dosDateTimeToDate = dosDateTimeToDate;
  15. exports.validateFileName = validateFileName;
  16. exports.ZipFile = ZipFile;
  17. exports.Entry = Entry;
  18. exports.RandomAccessReader = RandomAccessReader;
  19. function open(path, options, callback) {
  20. if (typeof options === "function") {
  21. callback = options;
  22. options = null;
  23. }
  24. if (options == null) options = {};
  25. if (options.autoClose == null) options.autoClose = true;
  26. if (options.lazyEntries == null) options.lazyEntries = false;
  27. if (options.decodeStrings == null) options.decodeStrings = true;
  28. if (options.validateEntrySizes == null) options.validateEntrySizes = true;
  29. if (options.strictFileNames == null) options.strictFileNames = false;
  30. if (callback == null) callback = defaultCallback;
  31. fs.open(path, "r", function(err, fd) {
  32. if (err) return callback(err);
  33. fromFd(fd, options, function(err, zipfile) {
  34. if (err) fs.close(fd, defaultCallback);
  35. callback(err, zipfile);
  36. });
  37. });
  38. }
  39. function fromFd(fd, options, callback) {
  40. if (typeof options === "function") {
  41. callback = options;
  42. options = null;
  43. }
  44. if (options == null) options = {};
  45. if (options.autoClose == null) options.autoClose = false;
  46. if (options.lazyEntries == null) options.lazyEntries = false;
  47. if (options.decodeStrings == null) options.decodeStrings = true;
  48. if (options.validateEntrySizes == null) options.validateEntrySizes = true;
  49. if (options.strictFileNames == null) options.strictFileNames = false;
  50. if (callback == null) callback = defaultCallback;
  51. fs.fstat(fd, function(err, stats) {
  52. if (err) return callback(err);
  53. var reader = fd_slicer.createFromFd(fd, {autoClose: true});
  54. fromRandomAccessReader(reader, stats.size, options, callback);
  55. });
  56. }
  57. function fromBuffer(buffer, options, callback) {
  58. if (typeof options === "function") {
  59. callback = options;
  60. options = null;
  61. }
  62. if (options == null) options = {};
  63. options.autoClose = false;
  64. if (options.lazyEntries == null) options.lazyEntries = false;
  65. if (options.decodeStrings == null) options.decodeStrings = true;
  66. if (options.validateEntrySizes == null) options.validateEntrySizes = true;
  67. if (options.strictFileNames == null) options.strictFileNames = false;
  68. // limit the max chunk size. see https://github.com/thejoshwolfe/yauzl/issues/87
  69. var reader = fd_slicer.createFromBuffer(buffer, {maxChunkSize: 0x10000});
  70. fromRandomAccessReader(reader, buffer.length, options, callback);
  71. }
  72. function fromRandomAccessReader(reader, totalSize, options, callback) {
  73. if (typeof options === "function") {
  74. callback = options;
  75. options = null;
  76. }
  77. if (options == null) options = {};
  78. if (options.autoClose == null) options.autoClose = true;
  79. if (options.lazyEntries == null) options.lazyEntries = false;
  80. if (options.decodeStrings == null) options.decodeStrings = true;
  81. var decodeStrings = !!options.decodeStrings;
  82. if (options.validateEntrySizes == null) options.validateEntrySizes = true;
  83. if (options.strictFileNames == null) options.strictFileNames = false;
  84. if (callback == null) callback = defaultCallback;
  85. if (typeof totalSize !== "number") throw new Error("expected totalSize parameter to be a number");
  86. if (totalSize > Number.MAX_SAFE_INTEGER) {
  87. throw new Error("zip file too large. only file sizes up to 2^52 are supported due to JavaScript's Number type being an IEEE 754 double.");
  88. }
  89. // the matching unref() call is in zipfile.close()
  90. reader.ref();
  91. // eocdr means End of Central Directory Record.
  92. // search backwards for the eocdr signature.
  93. // the last field of the eocdr is a variable-length comment.
  94. // the comment size is encoded in a 2-byte field in the eocdr, which we can't find without trudging backwards through the comment to find it.
  95. // as a consequence of this design decision, it's possible to have ambiguous zip file metadata if a coherent eocdr was in the comment.
  96. // we search backwards for a eocdr signature, and hope that whoever made the zip file was smart enough to forbid the eocdr signature in the comment.
  97. var eocdrWithoutCommentSize = 22;
  98. var maxCommentSize = 0xffff; // 2-byte size
  99. var bufferSize = Math.min(eocdrWithoutCommentSize + maxCommentSize, totalSize);
  100. var buffer = newBuffer(bufferSize);
  101. var bufferReadStart = totalSize - buffer.length;
  102. readAndAssertNoEof(reader, buffer, 0, bufferSize, bufferReadStart, function(err) {
  103. if (err) return callback(err);
  104. for (var i = bufferSize - eocdrWithoutCommentSize; i >= 0; i -= 1) {
  105. if (buffer.readUInt32LE(i) !== 0x06054b50) continue;
  106. // found eocdr
  107. var eocdrBuffer = buffer.slice(i);
  108. // 0 - End of central directory signature = 0x06054b50
  109. // 4 - Number of this disk
  110. var diskNumber = eocdrBuffer.readUInt16LE(4);
  111. if (diskNumber !== 0) {
  112. return callback(new Error("multi-disk zip files are not supported: found disk number: " + diskNumber));
  113. }
  114. // 6 - Disk where central directory starts
  115. // 8 - Number of central directory records on this disk
  116. // 10 - Total number of central directory records
  117. var entryCount = eocdrBuffer.readUInt16LE(10);
  118. // 12 - Size of central directory (bytes)
  119. // 16 - Offset of start of central directory, relative to start of archive
  120. var centralDirectoryOffset = eocdrBuffer.readUInt32LE(16);
  121. // 20 - Comment length
  122. var commentLength = eocdrBuffer.readUInt16LE(20);
  123. var expectedCommentLength = eocdrBuffer.length - eocdrWithoutCommentSize;
  124. if (commentLength !== expectedCommentLength) {
  125. return callback(new Error("invalid comment length. expected: " + expectedCommentLength + ". found: " + commentLength));
  126. }
  127. // 22 - Comment
  128. // the encoding is always cp437.
  129. var comment = decodeStrings ? decodeBuffer(eocdrBuffer, 22, eocdrBuffer.length, false)
  130. : eocdrBuffer.slice(22);
  131. if (!(entryCount === 0xffff || centralDirectoryOffset === 0xffffffff)) {
  132. return callback(null, new ZipFile(reader, centralDirectoryOffset, totalSize, entryCount, comment, options.autoClose, options.lazyEntries, decodeStrings, options.validateEntrySizes, options.strictFileNames));
  133. }
  134. // ZIP64 format
  135. // ZIP64 Zip64 end of central directory locator
  136. var zip64EocdlBuffer = newBuffer(20);
  137. var zip64EocdlOffset = bufferReadStart + i - zip64EocdlBuffer.length;
  138. readAndAssertNoEof(reader, zip64EocdlBuffer, 0, zip64EocdlBuffer.length, zip64EocdlOffset, function(err) {
  139. if (err) return callback(err);
  140. // 0 - zip64 end of central dir locator signature = 0x07064b50
  141. if (zip64EocdlBuffer.readUInt32LE(0) !== 0x07064b50) {
  142. return callback(new Error("invalid zip64 end of central directory locator signature"));
  143. }
  144. // 4 - number of the disk with the start of the zip64 end of central directory
  145. // 8 - relative offset of the zip64 end of central directory record
  146. var zip64EocdrOffset = readUInt64LE(zip64EocdlBuffer, 8);
  147. // 16 - total number of disks
  148. // ZIP64 end of central directory record
  149. var zip64EocdrBuffer = newBuffer(56);
  150. readAndAssertNoEof(reader, zip64EocdrBuffer, 0, zip64EocdrBuffer.length, zip64EocdrOffset, function(err) {
  151. if (err) return callback(err);
  152. // 0 - zip64 end of central dir signature 4 bytes (0x06064b50)
  153. if (zip64EocdrBuffer.readUInt32LE(0) !== 0x06064b50) {
  154. return callback(new Error("invalid zip64 end of central directory record signature"));
  155. }
  156. // 4 - size of zip64 end of central directory record 8 bytes
  157. // 12 - version made by 2 bytes
  158. // 14 - version needed to extract 2 bytes
  159. // 16 - number of this disk 4 bytes
  160. // 20 - number of the disk with the start of the central directory 4 bytes
  161. // 24 - total number of entries in the central directory on this disk 8 bytes
  162. // 32 - total number of entries in the central directory 8 bytes
  163. entryCount = readUInt64LE(zip64EocdrBuffer, 32);
  164. // 40 - size of the central directory 8 bytes
  165. // 48 - offset of start of central directory with respect to the starting disk number 8 bytes
  166. centralDirectoryOffset = readUInt64LE(zip64EocdrBuffer, 48);
  167. // 56 - zip64 extensible data sector (variable size)
  168. return callback(null, new ZipFile(reader, centralDirectoryOffset, totalSize, entryCount, comment, options.autoClose, options.lazyEntries, decodeStrings, options.validateEntrySizes, options.strictFileNames));
  169. });
  170. });
  171. return;
  172. }
  173. callback(new Error("end of central directory record signature not found"));
  174. });
  175. }
  176. util.inherits(ZipFile, EventEmitter);
  177. function ZipFile(reader, centralDirectoryOffset, fileSize, entryCount, comment, autoClose, lazyEntries, decodeStrings, validateEntrySizes, strictFileNames) {
  178. var self = this;
  179. EventEmitter.call(self);
  180. self.reader = reader;
  181. // forward close events
  182. self.reader.on("error", function(err) {
  183. // error closing the fd
  184. emitError(self, err);
  185. });
  186. self.reader.once("close", function() {
  187. self.emit("close");
  188. });
  189. self.readEntryCursor = centralDirectoryOffset;
  190. self.fileSize = fileSize;
  191. self.entryCount = entryCount;
  192. self.comment = comment;
  193. self.entriesRead = 0;
  194. self.autoClose = !!autoClose;
  195. self.lazyEntries = !!lazyEntries;
  196. self.decodeStrings = !!decodeStrings;
  197. self.validateEntrySizes = !!validateEntrySizes;
  198. self.strictFileNames = !!strictFileNames;
  199. self.isOpen = true;
  200. self.emittedError = false;
  201. if (!self.lazyEntries) self._readEntry();
  202. }
  203. ZipFile.prototype.close = function() {
  204. if (!this.isOpen) return;
  205. this.isOpen = false;
  206. this.reader.unref();
  207. };
  208. function emitErrorAndAutoClose(self, err) {
  209. if (self.autoClose) self.close();
  210. emitError(self, err);
  211. }
  212. function emitError(self, err) {
  213. if (self.emittedError) return;
  214. self.emittedError = true;
  215. self.emit("error", err);
  216. }
  217. ZipFile.prototype.readEntry = function() {
  218. if (!this.lazyEntries) throw new Error("readEntry() called without lazyEntries:true");
  219. this._readEntry();
  220. };
  221. ZipFile.prototype._readEntry = function() {
  222. var self = this;
  223. if (self.entryCount === self.entriesRead) {
  224. // done with metadata
  225. setImmediate(function() {
  226. if (self.autoClose) self.close();
  227. if (self.emittedError) return;
  228. self.emit("end");
  229. });
  230. return;
  231. }
  232. if (self.emittedError) return;
  233. var buffer = newBuffer(46);
  234. readAndAssertNoEof(self.reader, buffer, 0, buffer.length, self.readEntryCursor, function(err) {
  235. if (err) return emitErrorAndAutoClose(self, err);
  236. if (self.emittedError) return;
  237. var entry = new Entry();
  238. // 0 - Central directory file header signature
  239. var signature = buffer.readUInt32LE(0);
  240. if (signature !== 0x02014b50) return emitErrorAndAutoClose(self, new Error("invalid central directory file header signature: 0x" + signature.toString(16)));
  241. // 4 - Version made by
  242. entry.versionMadeBy = buffer.readUInt16LE(4);
  243. // 6 - Version needed to extract (minimum)
  244. entry.versionNeededToExtract = buffer.readUInt16LE(6);
  245. // 8 - General purpose bit flag
  246. entry.generalPurposeBitFlag = buffer.readUInt16LE(8);
  247. // 10 - Compression method
  248. entry.compressionMethod = buffer.readUInt16LE(10);
  249. // 12 - File last modification time
  250. entry.lastModFileTime = buffer.readUInt16LE(12);
  251. // 14 - File last modification date
  252. entry.lastModFileDate = buffer.readUInt16LE(14);
  253. // 16 - CRC-32
  254. entry.crc32 = buffer.readUInt32LE(16);
  255. // 20 - Compressed size
  256. entry.compressedSize = buffer.readUInt32LE(20);
  257. // 24 - Uncompressed size
  258. entry.uncompressedSize = buffer.readUInt32LE(24);
  259. // 28 - File name length (n)
  260. entry.fileNameLength = buffer.readUInt16LE(28);
  261. // 30 - Extra field length (m)
  262. entry.extraFieldLength = buffer.readUInt16LE(30);
  263. // 32 - File comment length (k)
  264. entry.fileCommentLength = buffer.readUInt16LE(32);
  265. // 34 - Disk number where file starts
  266. // 36 - Internal file attributes
  267. entry.internalFileAttributes = buffer.readUInt16LE(36);
  268. // 38 - External file attributes
  269. entry.externalFileAttributes = buffer.readUInt32LE(38);
  270. // 42 - Relative offset of local file header
  271. entry.relativeOffsetOfLocalHeader = buffer.readUInt32LE(42);
  272. if (entry.generalPurposeBitFlag & 0x40) return emitErrorAndAutoClose(self, new Error("strong encryption is not supported"));
  273. self.readEntryCursor += 46;
  274. buffer = newBuffer(entry.fileNameLength + entry.extraFieldLength + entry.fileCommentLength);
  275. readAndAssertNoEof(self.reader, buffer, 0, buffer.length, self.readEntryCursor, function(err) {
  276. if (err) return emitErrorAndAutoClose(self, err);
  277. if (self.emittedError) return;
  278. // 46 - File name
  279. var isUtf8 = (entry.generalPurposeBitFlag & 0x800) !== 0;
  280. entry.fileName = self.decodeStrings ? decodeBuffer(buffer, 0, entry.fileNameLength, isUtf8)
  281. : buffer.slice(0, entry.fileNameLength);
  282. // 46+n - Extra field
  283. var fileCommentStart = entry.fileNameLength + entry.extraFieldLength;
  284. var extraFieldBuffer = buffer.slice(entry.fileNameLength, fileCommentStart);
  285. entry.extraFields = [];
  286. var i = 0;
  287. while (i < extraFieldBuffer.length - 3) {
  288. var headerId = extraFieldBuffer.readUInt16LE(i + 0);
  289. var dataSize = extraFieldBuffer.readUInt16LE(i + 2);
  290. var dataStart = i + 4;
  291. var dataEnd = dataStart + dataSize;
  292. if (dataEnd > extraFieldBuffer.length) return emitErrorAndAutoClose(self, new Error("extra field length exceeds extra field buffer size"));
  293. var dataBuffer = newBuffer(dataSize);
  294. extraFieldBuffer.copy(dataBuffer, 0, dataStart, dataEnd);
  295. entry.extraFields.push({
  296. id: headerId,
  297. data: dataBuffer,
  298. });
  299. i = dataEnd;
  300. }
  301. // 46+n+m - File comment
  302. entry.fileComment = self.decodeStrings ? decodeBuffer(buffer, fileCommentStart, fileCommentStart + entry.fileCommentLength, isUtf8)
  303. : buffer.slice(fileCommentStart, fileCommentStart + entry.fileCommentLength);
  304. // compatibility hack for https://github.com/thejoshwolfe/yauzl/issues/47
  305. entry.comment = entry.fileComment;
  306. self.readEntryCursor += buffer.length;
  307. self.entriesRead += 1;
  308. if (entry.uncompressedSize === 0xffffffff ||
  309. entry.compressedSize === 0xffffffff ||
  310. entry.relativeOffsetOfLocalHeader === 0xffffffff) {
  311. // ZIP64 format
  312. // find the Zip64 Extended Information Extra Field
  313. var zip64EiefBuffer = null;
  314. for (var i = 0; i < entry.extraFields.length; i++) {
  315. var extraField = entry.extraFields[i];
  316. if (extraField.id === 0x0001) {
  317. zip64EiefBuffer = extraField.data;
  318. break;
  319. }
  320. }
  321. if (zip64EiefBuffer == null) {
  322. return emitErrorAndAutoClose(self, new Error("expected zip64 extended information extra field"));
  323. }
  324. var index = 0;
  325. // 0 - Original Size 8 bytes
  326. if (entry.uncompressedSize === 0xffffffff) {
  327. if (index + 8 > zip64EiefBuffer.length) {
  328. return emitErrorAndAutoClose(self, new Error("zip64 extended information extra field does not include uncompressed size"));
  329. }
  330. entry.uncompressedSize = readUInt64LE(zip64EiefBuffer, index);
  331. index += 8;
  332. }
  333. // 8 - Compressed Size 8 bytes
  334. if (entry.compressedSize === 0xffffffff) {
  335. if (index + 8 > zip64EiefBuffer.length) {
  336. return emitErrorAndAutoClose(self, new Error("zip64 extended information extra field does not include compressed size"));
  337. }
  338. entry.compressedSize = readUInt64LE(zip64EiefBuffer, index);
  339. index += 8;
  340. }
  341. // 16 - Relative Header Offset 8 bytes
  342. if (entry.relativeOffsetOfLocalHeader === 0xffffffff) {
  343. if (index + 8 > zip64EiefBuffer.length) {
  344. return emitErrorAndAutoClose(self, new Error("zip64 extended information extra field does not include relative header offset"));
  345. }
  346. entry.relativeOffsetOfLocalHeader = readUInt64LE(zip64EiefBuffer, index);
  347. index += 8;
  348. }
  349. // 24 - Disk Start Number 4 bytes
  350. }
  351. // check for Info-ZIP Unicode Path Extra Field (0x7075)
  352. // see https://github.com/thejoshwolfe/yauzl/issues/33
  353. if (self.decodeStrings) {
  354. for (var i = 0; i < entry.extraFields.length; i++) {
  355. var extraField = entry.extraFields[i];
  356. if (extraField.id === 0x7075) {
  357. if (extraField.data.length < 6) {
  358. // too short to be meaningful
  359. continue;
  360. }
  361. // Version 1 byte version of this extra field, currently 1
  362. if (extraField.data.readUInt8(0) !== 1) {
  363. // > Changes may not be backward compatible so this extra
  364. // > field should not be used if the version is not recognized.
  365. continue;
  366. }
  367. // NameCRC32 4 bytes File Name Field CRC32 Checksum
  368. var oldNameCrc32 = extraField.data.readUInt32LE(1);
  369. if (crc32.unsigned(buffer.slice(0, entry.fileNameLength)) !== oldNameCrc32) {
  370. // > If the CRC check fails, this UTF-8 Path Extra Field should be
  371. // > ignored and the File Name field in the header should be used instead.
  372. continue;
  373. }
  374. // UnicodeName Variable UTF-8 version of the entry File Name
  375. entry.fileName = decodeBuffer(extraField.data, 5, extraField.data.length, true);
  376. break;
  377. }
  378. }
  379. }
  380. // validate file size
  381. if (self.validateEntrySizes && entry.compressionMethod === 0) {
  382. var expectedCompressedSize = entry.uncompressedSize;
  383. if (entry.isEncrypted()) {
  384. // traditional encryption prefixes the file data with a header
  385. expectedCompressedSize += 12;
  386. }
  387. if (entry.compressedSize !== expectedCompressedSize) {
  388. var msg = "compressed/uncompressed size mismatch for stored file: " + entry.compressedSize + " != " + entry.uncompressedSize;
  389. return emitErrorAndAutoClose(self, new Error(msg));
  390. }
  391. }
  392. if (self.decodeStrings) {
  393. if (!self.strictFileNames) {
  394. // allow backslash
  395. entry.fileName = entry.fileName.replace(/\\/g, "/");
  396. }
  397. var errorMessage = validateFileName(entry.fileName, self.validateFileNameOptions);
  398. if (errorMessage != null) return emitErrorAndAutoClose(self, new Error(errorMessage));
  399. }
  400. self.emit("entry", entry);
  401. if (!self.lazyEntries) self._readEntry();
  402. });
  403. });
  404. };
  405. ZipFile.prototype.openReadStream = function(entry, options, callback) {
  406. var self = this;
  407. // parameter validation
  408. var relativeStart = 0;
  409. var relativeEnd = entry.compressedSize;
  410. if (callback == null) {
  411. callback = options;
  412. options = {};
  413. } else {
  414. // validate options that the caller has no excuse to get wrong
  415. if (options.decrypt != null) {
  416. if (!entry.isEncrypted()) {
  417. throw new Error("options.decrypt can only be specified for encrypted entries");
  418. }
  419. if (options.decrypt !== false) throw new Error("invalid options.decrypt value: " + options.decrypt);
  420. if (entry.isCompressed()) {
  421. if (options.decompress !== false) throw new Error("entry is encrypted and compressed, and options.decompress !== false");
  422. }
  423. }
  424. if (options.decompress != null) {
  425. if (!entry.isCompressed()) {
  426. throw new Error("options.decompress can only be specified for compressed entries");
  427. }
  428. if (!(options.decompress === false || options.decompress === true)) {
  429. throw new Error("invalid options.decompress value: " + options.decompress);
  430. }
  431. }
  432. if (options.start != null || options.end != null) {
  433. if (entry.isCompressed() && options.decompress !== false) {
  434. throw new Error("start/end range not allowed for compressed entry without options.decompress === false");
  435. }
  436. if (entry.isEncrypted() && options.decrypt !== false) {
  437. throw new Error("start/end range not allowed for encrypted entry without options.decrypt === false");
  438. }
  439. }
  440. if (options.start != null) {
  441. relativeStart = options.start;
  442. if (relativeStart < 0) throw new Error("options.start < 0");
  443. if (relativeStart > entry.compressedSize) throw new Error("options.start > entry.compressedSize");
  444. }
  445. if (options.end != null) {
  446. relativeEnd = options.end;
  447. if (relativeEnd < 0) throw new Error("options.end < 0");
  448. if (relativeEnd > entry.compressedSize) throw new Error("options.end > entry.compressedSize");
  449. if (relativeEnd < relativeStart) throw new Error("options.end < options.start");
  450. }
  451. }
  452. // any further errors can either be caused by the zipfile,
  453. // or were introduced in a minor version of yauzl,
  454. // so should be passed to the client rather than thrown.
  455. if (!self.isOpen) return callback(new Error("closed"));
  456. if (entry.isEncrypted()) {
  457. if (options.decrypt !== false) return callback(new Error("entry is encrypted, and options.decrypt !== false"));
  458. }
  459. // make sure we don't lose the fd before we open the actual read stream
  460. self.reader.ref();
  461. var buffer = newBuffer(30);
  462. readAndAssertNoEof(self.reader, buffer, 0, buffer.length, entry.relativeOffsetOfLocalHeader, function(err) {
  463. try {
  464. if (err) return callback(err);
  465. // 0 - Local file header signature = 0x04034b50
  466. var signature = buffer.readUInt32LE(0);
  467. if (signature !== 0x04034b50) {
  468. return callback(new Error("invalid local file header signature: 0x" + signature.toString(16)));
  469. }
  470. // all this should be redundant
  471. // 4 - Version needed to extract (minimum)
  472. // 6 - General purpose bit flag
  473. // 8 - Compression method
  474. // 10 - File last modification time
  475. // 12 - File last modification date
  476. // 14 - CRC-32
  477. // 18 - Compressed size
  478. // 22 - Uncompressed size
  479. // 26 - File name length (n)
  480. var fileNameLength = buffer.readUInt16LE(26);
  481. // 28 - Extra field length (m)
  482. var extraFieldLength = buffer.readUInt16LE(28);
  483. // 30 - File name
  484. // 30+n - Extra field
  485. var localFileHeaderEnd = entry.relativeOffsetOfLocalHeader + buffer.length + fileNameLength + extraFieldLength;
  486. var decompress;
  487. if (entry.compressionMethod === 0) {
  488. // 0 - The file is stored (no compression)
  489. decompress = false;
  490. } else if (entry.compressionMethod === 8) {
  491. // 8 - The file is Deflated
  492. decompress = options.decompress != null ? options.decompress : true;
  493. } else {
  494. return callback(new Error("unsupported compression method: " + entry.compressionMethod));
  495. }
  496. var fileDataStart = localFileHeaderEnd;
  497. var fileDataEnd = fileDataStart + entry.compressedSize;
  498. if (entry.compressedSize !== 0) {
  499. // bounds check now, because the read streams will probably not complain loud enough.
  500. // since we're dealing with an unsigned offset plus an unsigned size,
  501. // we only have 1 thing to check for.
  502. if (fileDataEnd > self.fileSize) {
  503. return callback(new Error("file data overflows file bounds: " +
  504. fileDataStart + " + " + entry.compressedSize + " > " + self.fileSize));
  505. }
  506. }
  507. var readStream = self.reader.createReadStream({
  508. start: fileDataStart + relativeStart,
  509. end: fileDataStart + relativeEnd,
  510. });
  511. var endpointStream = readStream;
  512. if (decompress) {
  513. var destroyed = false;
  514. var inflateFilter = zlib.createInflateRaw();
  515. readStream.on("error", function(err) {
  516. // setImmediate here because errors can be emitted during the first call to pipe()
  517. setImmediate(function() {
  518. if (!destroyed) inflateFilter.emit("error", err);
  519. });
  520. });
  521. readStream.pipe(inflateFilter);
  522. if (self.validateEntrySizes) {
  523. endpointStream = new AssertByteCountStream(entry.uncompressedSize);
  524. inflateFilter.on("error", function(err) {
  525. // forward zlib errors to the client-visible stream
  526. setImmediate(function() {
  527. if (!destroyed) endpointStream.emit("error", err);
  528. });
  529. });
  530. inflateFilter.pipe(endpointStream);
  531. } else {
  532. // the zlib filter is the client-visible stream
  533. endpointStream = inflateFilter;
  534. }
  535. // this is part of yauzl's API, so implement this function on the client-visible stream
  536. endpointStream.destroy = function() {
  537. destroyed = true;
  538. if (inflateFilter !== endpointStream) inflateFilter.unpipe(endpointStream);
  539. readStream.unpipe(inflateFilter);
  540. // TODO: the inflateFilter may cause a memory leak. see Issue #27.
  541. readStream.destroy();
  542. };
  543. }
  544. callback(null, endpointStream);
  545. } finally {
  546. self.reader.unref();
  547. }
  548. });
  549. };
  550. function Entry() {
  551. }
  552. Entry.prototype.getLastModDate = function() {
  553. return dosDateTimeToDate(this.lastModFileDate, this.lastModFileTime);
  554. };
  555. Entry.prototype.isEncrypted = function() {
  556. return (this.generalPurposeBitFlag & 0x1) !== 0;
  557. };
  558. Entry.prototype.isCompressed = function() {
  559. return this.compressionMethod === 8;
  560. };
  561. function dosDateTimeToDate(date, time) {
  562. var day = date & 0x1f; // 1-31
  563. var month = (date >> 5 & 0xf) - 1; // 1-12, 0-11
  564. var year = (date >> 9 & 0x7f) + 1980; // 0-128, 1980-2108
  565. var millisecond = 0;
  566. var second = (time & 0x1f) * 2; // 0-29, 0-58 (even numbers)
  567. var minute = time >> 5 & 0x3f; // 0-59
  568. var hour = time >> 11 & 0x1f; // 0-23
  569. return new Date(year, month, day, hour, minute, second, millisecond);
  570. }
  571. function validateFileName(fileName) {
  572. if (fileName.indexOf("\\") !== -1) {
  573. return "invalid characters in fileName: " + fileName;
  574. }
  575. if (/^[a-zA-Z]:/.test(fileName) || /^\//.test(fileName)) {
  576. return "absolute path: " + fileName;
  577. }
  578. if (fileName.split("/").indexOf("..") !== -1) {
  579. return "invalid relative path: " + fileName;
  580. }
  581. // all good
  582. return null;
  583. }
  584. function readAndAssertNoEof(reader, buffer, offset, length, position, callback) {
  585. if (length === 0) {
  586. // fs.read will throw an out-of-bounds error if you try to read 0 bytes from a 0 byte file
  587. return setImmediate(function() { callback(null, newBuffer(0)); });
  588. }
  589. reader.read(buffer, offset, length, position, function(err, bytesRead) {
  590. if (err) return callback(err);
  591. if (bytesRead < length) {
  592. return callback(new Error("unexpected EOF"));
  593. }
  594. callback();
  595. });
  596. }
  597. util.inherits(AssertByteCountStream, Transform);
  598. function AssertByteCountStream(byteCount) {
  599. Transform.call(this);
  600. this.actualByteCount = 0;
  601. this.expectedByteCount = byteCount;
  602. }
  603. AssertByteCountStream.prototype._transform = function(chunk, encoding, cb) {
  604. this.actualByteCount += chunk.length;
  605. if (this.actualByteCount > this.expectedByteCount) {
  606. var msg = "too many bytes in the stream. expected " + this.expectedByteCount + ". got at least " + this.actualByteCount;
  607. return cb(new Error(msg));
  608. }
  609. cb(null, chunk);
  610. };
  611. AssertByteCountStream.prototype._flush = function(cb) {
  612. if (this.actualByteCount < this.expectedByteCount) {
  613. var msg = "not enough bytes in the stream. expected " + this.expectedByteCount + ". got only " + this.actualByteCount;
  614. return cb(new Error(msg));
  615. }
  616. cb();
  617. };
  618. util.inherits(RandomAccessReader, EventEmitter);
  619. function RandomAccessReader() {
  620. EventEmitter.call(this);
  621. this.refCount = 0;
  622. }
  623. RandomAccessReader.prototype.ref = function() {
  624. this.refCount += 1;
  625. };
  626. RandomAccessReader.prototype.unref = function() {
  627. var self = this;
  628. self.refCount -= 1;
  629. if (self.refCount > 0) return;
  630. if (self.refCount < 0) throw new Error("invalid unref");
  631. self.close(onCloseDone);
  632. function onCloseDone(err) {
  633. if (err) return self.emit('error', err);
  634. self.emit('close');
  635. }
  636. };
  637. RandomAccessReader.prototype.createReadStream = function(options) {
  638. var start = options.start;
  639. var end = options.end;
  640. if (start === end) {
  641. var emptyStream = new PassThrough();
  642. setImmediate(function() {
  643. emptyStream.end();
  644. });
  645. return emptyStream;
  646. }
  647. var stream = this._readStreamForRange(start, end);
  648. var destroyed = false;
  649. var refUnrefFilter = new RefUnrefFilter(this);
  650. stream.on("error", function(err) {
  651. setImmediate(function() {
  652. if (!destroyed) refUnrefFilter.emit("error", err);
  653. });
  654. });
  655. refUnrefFilter.destroy = function() {
  656. stream.unpipe(refUnrefFilter);
  657. refUnrefFilter.unref();
  658. stream.destroy();
  659. };
  660. var byteCounter = new AssertByteCountStream(end - start);
  661. refUnrefFilter.on("error", function(err) {
  662. setImmediate(function() {
  663. if (!destroyed) byteCounter.emit("error", err);
  664. });
  665. });
  666. byteCounter.destroy = function() {
  667. destroyed = true;
  668. refUnrefFilter.unpipe(byteCounter);
  669. refUnrefFilter.destroy();
  670. };
  671. return stream.pipe(refUnrefFilter).pipe(byteCounter);
  672. };
  673. RandomAccessReader.prototype._readStreamForRange = function(start, end) {
  674. throw new Error("not implemented");
  675. };
  676. RandomAccessReader.prototype.read = function(buffer, offset, length, position, callback) {
  677. var readStream = this.createReadStream({start: position, end: position + length});
  678. var writeStream = new Writable();
  679. var written = 0;
  680. writeStream._write = function(chunk, encoding, cb) {
  681. chunk.copy(buffer, offset + written, 0, chunk.length);
  682. written += chunk.length;
  683. cb();
  684. };
  685. writeStream.on("finish", callback);
  686. readStream.on("error", function(error) {
  687. callback(error);
  688. });
  689. readStream.pipe(writeStream);
  690. };
  691. RandomAccessReader.prototype.close = function(callback) {
  692. setImmediate(callback);
  693. };
  694. util.inherits(RefUnrefFilter, PassThrough);
  695. function RefUnrefFilter(context) {
  696. PassThrough.call(this);
  697. this.context = context;
  698. this.context.ref();
  699. this.unreffedYet = false;
  700. }
  701. RefUnrefFilter.prototype._flush = function(cb) {
  702. this.unref();
  703. cb();
  704. };
  705. RefUnrefFilter.prototype.unref = function(cb) {
  706. if (this.unreffedYet) return;
  707. this.unreffedYet = true;
  708. this.context.unref();
  709. };
  710. var cp437 = '\u0000☺☻♥♦♣♠•◘○◙♂♀♪♫☼►◄↕‼¶§▬↨↑↓→←∟↔▲▼ !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒáíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ';
  711. function decodeBuffer(buffer, start, end, isUtf8) {
  712. if (isUtf8) {
  713. return buffer.toString("utf8", start, end);
  714. } else {
  715. var result = "";
  716. for (var i = start; i < end; i++) {
  717. result += cp437[buffer[i]];
  718. }
  719. return result;
  720. }
  721. }
  722. function readUInt64LE(buffer, offset) {
  723. // there is no native function for this, because we can't actually store 64-bit integers precisely.
  724. // after 53 bits, JavaScript's Number type (IEEE 754 double) can't store individual integers anymore.
  725. // but since 53 bits is a whole lot more than 32 bits, we do our best anyway.
  726. var lower32 = buffer.readUInt32LE(offset);
  727. var upper32 = buffer.readUInt32LE(offset + 4);
  728. // we can't use bitshifting here, because JavaScript bitshifting only works on 32-bit integers.
  729. return upper32 * 0x100000000 + lower32;
  730. // as long as we're bounds checking the result of this function against the total file size,
  731. // we'll catch any overflow errors, because we already made sure the total file size was within reason.
  732. }
  733. // Node 10 deprecated new Buffer().
  734. var newBuffer;
  735. if (typeof Buffer.allocUnsafe === "function") {
  736. newBuffer = function(len) {
  737. return Buffer.allocUnsafe(len);
  738. };
  739. } else {
  740. newBuffer = function(len) {
  741. return new Buffer(len);
  742. };
  743. }
  744. function defaultCallback(err) {
  745. if (err) throw err;
  746. }