Skip to content

Commit

Permalink
fix: change output to filename for Disclosure/DoS/RCE
Browse files Browse the repository at this point in the history
  • Loading branch information
yuda-lyu committed Oct 22, 2021
1 parent 47935d9 commit d7039d0
Show file tree
Hide file tree
Showing 12 changed files with 44 additions and 40 deletions.
4 changes: 2 additions & 2 deletions dist/w-zip.umd.js

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/w-zip.umd.js.map

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion docs/index.html
Expand Up @@ -68,7 +68,7 @@ <h3> </h3>
<br class="clear">

<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Tue Oct 12 2021 11:02:15 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Fri Oct 22 2021 12:13:27 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>

<script>prettyPrint();</script>
Expand Down
12 changes: 6 additions & 6 deletions docs/m7z.html
Expand Up @@ -71,7 +71,7 @@ <h4 class="name" id="m7z"><span class="type-signature"></span>new m7z<span class

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line87">line 87</a>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line88">line 88</a>
</li></ul></dd>


Expand Down Expand Up @@ -206,7 +206,7 @@ <h4 class="name" id=".setProg"><span class="type-signature">(static) </span>setP

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line98">line 98</a>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line99">line 99</a>
</li></ul></dd>


Expand Down Expand Up @@ -384,7 +384,7 @@ <h4 class="name" id=".unzip"><span class="type-signature">(async, static) </span

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line243">line 243</a>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line244">line 244</a>
</li></ul></dd>


Expand Down Expand Up @@ -701,7 +701,7 @@ <h4 class="name" id=".zipFile"><span class="type-signature">(async, static) </sp

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line146">line 146</a>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line147">line 147</a>
</li></ul></dd>


Expand Down Expand Up @@ -1043,7 +1043,7 @@ <h4 class="name" id=".zipFolder"><span class="type-signature">(async, static) </

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line195">line 195</a>
<a href="m7z.mjs.html">m7z.mjs</a>, <a href="m7z.mjs.html#line196">line 196</a>
</li></ul></dd>


Expand Down Expand Up @@ -1388,7 +1388,7 @@ <h5>Returns:</h5>
<br class="clear">

<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Tue Oct 12 2021 11:02:16 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Fri Oct 22 2021 12:13:27 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>

<script>prettyPrint();</script>
Expand Down
5 changes: 3 additions & 2 deletions docs/m7z.mjs.html
Expand Up @@ -45,6 +45,7 @@ <h1 class="page-title">m7z.mjs</h1>
<pre class="prettyprint source linenums"><code>import fs from 'fs'
import get from 'lodash/get'
import execScript from 'wsemi/src/execScript.mjs'
import getFileName from 'wsemi/src/getFileName.mjs'
import checkTarget from './checkTarget.mjs'


Expand Down Expand Up @@ -325,7 +326,7 @@ <h1 class="page-title">m7z.mjs</h1>
}

return {
state: 'finish: ' + fpTar, //7z順利結束不代表就是順利完成加解壓縮
state: 'finish: ' + getFileName(fpTar), //7z順利結束不代表就是順利完成加解壓縮
msg7z: r,
}
}
Expand Down Expand Up @@ -355,7 +356,7 @@ <h1 class="page-title">m7z.mjs</h1>
<br class="clear">

<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Tue Oct 12 2021 11:02:15 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Fri Oct 22 2021 12:13:27 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>

<script>prettyPrint();</script>
Expand Down
10 changes: 5 additions & 5 deletions docs/mZip.html
Expand Up @@ -71,7 +71,7 @@ <h4 class="name" id="mZip"><span class="type-signature"></span>new mZip<span cla

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line92">line 92</a>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line93">line 93</a>
</li></ul></dd>


Expand Down Expand Up @@ -206,7 +206,7 @@ <h4 class="name" id=".unzip"><span class="type-signature">(async, static) </span

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line277">line 277</a>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line278">line 278</a>
</li></ul></dd>


Expand Down Expand Up @@ -523,7 +523,7 @@ <h4 class="name" id=".zipFile"><span class="type-signature">(async, static) </sp

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line106">line 106</a>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line107">line 107</a>
</li></ul></dd>


Expand Down Expand Up @@ -865,7 +865,7 @@ <h4 class="name" id=".zipFolder"><span class="type-signature">(async, static) </

<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line191">line 191</a>
<a href="mZip.mjs.html">mZip.mjs</a>, <a href="mZip.mjs.html#line192">line 192</a>
</li></ul></dd>


Expand Down Expand Up @@ -1072,7 +1072,7 @@ <h5>Returns:</h5>
<br class="clear">

<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Tue Oct 12 2021 11:02:16 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Fri Oct 22 2021 12:13:27 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>

<script>prettyPrint();</script>
Expand Down
5 changes: 3 additions & 2 deletions docs/mZip.mjs.html
Expand Up @@ -50,6 +50,7 @@ <h1 class="page-title">mZip.mjs</h1>
import get from 'lodash/get'
import genPm from 'wsemi/src/genPm.mjs'
import pmMap from 'wsemi/src/pmMap.mjs'
import getFileName from 'wsemi/src/getFileName.mjs'
import checkTarget from './checkTarget.mjs'


Expand Down Expand Up @@ -398,7 +399,7 @@ <h1 class="page-title">mZip.mjs</h1>
//extract
await extract(fpSrc, fpTar, pw)

return Promise.resolve('done: ' + fpTar)
return Promise.resolve('done: ' + getFileName(fpTar))
}
catch (err) {
return Promise.reject(err)
Expand Down Expand Up @@ -429,7 +430,7 @@ <h1 class="page-title">mZip.mjs</h1>
<br class="clear">

<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Tue Oct 12 2021 11:02:15 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.6.6</a> on Fri Oct 22 2021 12:13:27 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>

<script>prettyPrint();</script>
Expand Down
34 changes: 17 additions & 17 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions package.json
@@ -1,14 +1,14 @@
{
"name": "w-zip",
"version": "1.0.11",
"version": "1.0.12",
"description": "A compression tool with zip and 7z.",
"main": "dist/w-zip.umd.js",
"dependencies": {
"archiver": "^5.3.0",
"archiver-zip-encrypted": "^1.0.10",
"unzipper": "^0.10.11",
"lodash": "^4.17.21",
"wsemi": "^1.6.19"
"wsemi": "^1.6.26"
},
"devDependencies": {
"w-package-tools": "^1.0.59"
Expand Down
3 changes: 2 additions & 1 deletion src/m7z.mjs
@@ -1,6 +1,7 @@
import fs from 'fs'
import get from 'lodash/get'
import execScript from 'wsemi/src/execScript.mjs'
import getFileName from 'wsemi/src/getFileName.mjs'
import checkTarget from './checkTarget.mjs'


Expand Down Expand Up @@ -281,7 +282,7 @@ function m7z() {
}

return {
state: 'finish: ' + fpTar, //7z順利結束不代表就是順利完成加解壓縮
state: 'finish: ' + getFileName(fpTar), //7z順利結束不代表就是順利完成加解壓縮
msg7z: r,
}
}
Expand Down
3 changes: 2 additions & 1 deletion src/mZip.mjs
Expand Up @@ -6,6 +6,7 @@ import unzipper from 'unzipper'
import get from 'lodash/get'
import genPm from 'wsemi/src/genPm.mjs'
import pmMap from 'wsemi/src/pmMap.mjs'
import getFileName from 'wsemi/src/getFileName.mjs'
import checkTarget from './checkTarget.mjs'


Expand Down Expand Up @@ -354,7 +355,7 @@ function mZip() {
//extract
await extract(fpSrc, fpTar, pw)

return Promise.resolve('done: ' + fpTar)
return Promise.resolve('done: ' + getFileName(fpTar))
}
catch (err) {
return Promise.reject(err)
Expand Down
Binary file modified testData/outputZip/test2PW.zip
Binary file not shown.

3 comments on commit d7039d0

@JamieSlome
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yuda-lyu - @sheldor2021 has requested a CVE for this report. Are you happy for us to go ahead and publish one?

@yuda-lyu
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, no problem.

@JamieSlome
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yuda-lyu - CVE published! ❤️

CVE-2022-0401

Please sign in to comment.