diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index 1eab7c8ed..3b43882d6 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -461,6 +461,11 @@ along with Dependency-Check. If not, see . 1.7.2 jar + + org.apache.commons + commons-compress + 1.5 + + + com.hazelcast + hazelcast + 2.5 + test + diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java index bcc36fdbd..80f926369 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java @@ -32,8 +32,11 @@ import java.util.List; import java.util.Set; import java.util.logging.Level; import java.util.logging.Logger; -import java.util.zip.ZipEntry; -import java.util.zip.ZipInputStream; +//import java.util.zip.ZipEntry; +//import java.util.zip.ZipException; +//import java.util.zip.ZipInputStream; +import org.apache.commons.compress.archivers.zip.ZipArchiveEntry; +import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream; import org.h2.store.fs.FileUtils; import org.owasp.dependencycheck.Engine; import org.owasp.dependencycheck.dependency.Dependency; @@ -243,7 +246,8 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { } FileInputStream fis = null; - ZipInputStream zis = null; + //ZipInputStream zis = null; + ZipArchiveInputStream zis = null; try { fis = new FileInputStream(archive); @@ -251,10 +255,11 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex); throw new AnalysisException("Archive file was not found.", ex); } - zis = new ZipInputStream(new BufferedInputStream(fis)); - ZipEntry entry; + zis = new ZipArchiveInputStream(new BufferedInputStream(fis)); + ZipArchiveEntry entry; + try { - while ((entry = zis.getNextEntry()) != null) { + while ((entry = zis.getNextZipEntry()) != null) { if (entry.isDirectory()) { final File d = new File(extractTo, entry.getName()); if (!d.mkdirs()) { @@ -295,7 +300,13 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { } } catch (IOException ex) { final String msg = String.format("Exception reading archive '%s'.", archive.getName()); - Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, msg, ex); + Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); + Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); + throw new AnalysisException(msg, ex); + } catch (Throwable ex) { + final String msg = String.format("Exception reading archive '%s'.", archive.getName()); + Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); + Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, null, ex); throw new AnalysisException(msg, ex); } finally { try { diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java index fa2989d5b..62032c6c5 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java @@ -154,4 +154,29 @@ public class ArchiveAnalyzerTest { instance.close(); } } + + /** + * Test of analyze method, of class ArchiveAnalyzer. + */ + @Test + public void testAnalyze_badZip() throws Exception { + ArchiveAnalyzer instance = new ArchiveAnalyzer(); + try { + instance.initialize(); + + File file = new File(this.getClass().getClassLoader().getResource("test.zip").getPath()); + Dependency dependency = new Dependency(file); + Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); + Engine engine = new Engine(); + + int initial_size = engine.getDependencies().size(); + instance.analyze(dependency, engine); + int ending_size = engine.getDependencies().size(); + + assertTrue(initial_size == ending_size); + + } finally { + instance.close(); + } + } }