diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml
index 1eab7c8ed..3b43882d6 100644
--- a/dependency-check-core/pom.xml
+++ b/dependency-check-core/pom.xml
@@ -461,6 +461,11 @@ along with Dependency-Check. If not, see .
1.7.2
jar
+
+ org.apache.commons
+ commons-compress
+ 1.5
+
+
+ com.hazelcast
+ hazelcast
+ 2.5
+ test
+
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
index bcc36fdbd..80f926369 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
@@ -32,8 +32,11 @@ import java.util.List;
import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
+//import java.util.zip.ZipEntry;
+//import java.util.zip.ZipException;
+//import java.util.zip.ZipInputStream;
+import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
+import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
import org.h2.store.fs.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.dependency.Dependency;
@@ -243,7 +246,8 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
}
FileInputStream fis = null;
- ZipInputStream zis = null;
+ //ZipInputStream zis = null;
+ ZipArchiveInputStream zis = null;
try {
fis = new FileInputStream(archive);
@@ -251,10 +255,11 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex);
throw new AnalysisException("Archive file was not found.", ex);
}
- zis = new ZipInputStream(new BufferedInputStream(fis));
- ZipEntry entry;
+ zis = new ZipArchiveInputStream(new BufferedInputStream(fis));
+ ZipArchiveEntry entry;
+
try {
- while ((entry = zis.getNextEntry()) != null) {
+ while ((entry = zis.getNextZipEntry()) != null) {
if (entry.isDirectory()) {
final File d = new File(extractTo, entry.getName());
if (!d.mkdirs()) {
@@ -295,7 +300,13 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
}
} catch (IOException ex) {
final String msg = String.format("Exception reading archive '%s'.", archive.getName());
- Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, msg, ex);
+ Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
+ Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
+ throw new AnalysisException(msg, ex);
+ } catch (Throwable ex) {
+ final String msg = String.format("Exception reading archive '%s'.", archive.getName());
+ Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
+ Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, null, ex);
throw new AnalysisException(msg, ex);
} finally {
try {
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java
index fa2989d5b..62032c6c5 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java
@@ -154,4 +154,29 @@ public class ArchiveAnalyzerTest {
instance.close();
}
}
+
+ /**
+ * Test of analyze method, of class ArchiveAnalyzer.
+ */
+ @Test
+ public void testAnalyze_badZip() throws Exception {
+ ArchiveAnalyzer instance = new ArchiveAnalyzer();
+ try {
+ instance.initialize();
+
+ File file = new File(this.getClass().getClassLoader().getResource("test.zip").getPath());
+ Dependency dependency = new Dependency(file);
+ Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+ Engine engine = new Engine();
+
+ int initial_size = engine.getDependencies().size();
+ instance.analyze(dependency, engine);
+ int ending_size = engine.getDependencies().size();
+
+ assertTrue(initial_size == ending_size);
+
+ } finally {
+ instance.close();
+ }
+ }
}