Skip to content

Commit 963fe13

Browse files
armijnhemelfolkertdev
armijnhemel
authored and
folkertdev
committed
add test data for a file comment containing binary data
1 parent c4a7bef commit 963fe13

4 files changed

Lines changed: 192 additions & 0 deletions

File tree

‎testdata/binary_comment.zip‎

350 Bytes
Binary file not shown.

‎testdata/blue.png‎

162 Bytes
Loading

‎testdata/readme.binarycontentzip‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# File comment contents
2+
3+
The ZIP specification does not specify what the contents of a file
4+
comment can be. Intuitively it makes sense to assume that it should be text
5+
but it hasn't been defined. In fact, the Python `zipfile` module documentation
6+
says:
7+
8+
```
9+
ZipInfo.comment
10+
Comment for the individual archive member as a bytes object.
11+
```
12+
13+
Because it is a bytes object it basically means that there are no restrictions
14+
on the *contents* of the file comment itself and any kind of data is accepted
15+
when assembling a ZIP file using Python. For example, embedding a small PNG
16+
as a file comment is absolutely no problem at all:
17+
18+
```
19+
>>> import zipfile
20+
>>> z = zipfile.ZipInfo(40*'a')
21+
>>> test_image = open('blue.png', 'rb').read()
22+
>>> len(test_image)
23+
162
24+
>>> z.comment = test_image
25+
>>> contents = 10*b'c'
26+
>>> bla = zipfile.ZipFile('binary_comment.zip', mode='w')
27+
>>> bla.writestr(z, contents)
28+
>>> bla.close()
29+
```
30+
31+
When expecting the file with `hexdump` it is very easy to see that there
32+
is a PNG file embedded in the file comment:
33+
34+
```
35+
$ hexdump -C binary_comment.zip | grep PNG
36+
000000a0 61 61 61 61 61 61 89 50 4e 47 0d 0a 1a 0a 00 00 |aaaaaa.PNG......|
37+
```
38+
39+
`zipinfo` tries to display the content when run in verbose mode, but cannot:
40+
41+
```
42+
$ zipinfo -v binary_comment.zip
43+
Archive: binary_comment.zip
44+
There is no zipfile comment.
45+
46+
End-of-central-directory record:
47+
-------------------------------
48+
49+
Zip archive file size: 350 (000000000000015Eh)
50+
Actual end-cent-dir record offset: 328 (0000000000000148h)
51+
Expected end-cent-dir record offset: 328 (0000000000000148h)
52+
(based on the length of the central directory and its expected offset)
53+
54+
This zipfile constitutes the sole disk of a single-part archive; its
55+
central directory contains 1 entry.
56+
The central directory is 248 (00000000000000F8h) bytes long,
57+
and its (expected) offset in bytes from the beginning of the zipfile
58+
is 80 (0000000000000050h).
59+
60+
61+
Central directory entry #1:
62+
---------------------------
63+
64+
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
65+
66+
offset of local header from start of archive: 0
67+
(0000000000000000h) bytes
68+
file system or operating system of origin: Unix
69+
version of encoding software: 2.0
70+
minimum file system compatibility required: MS-DOS, OS/2 or NT FAT
71+
minimum software version required to extract: 2.0
72+
compression method: none (stored)
73+
file security status: not encrypted
74+
extended local header: no
75+
file last modified on (DOS date/time): 1980 Jan 1 00:00:00
76+
32-bit CRC value (hex): f115ce3f
77+
compressed size: 10 bytes
78+
uncompressed size: 10 bytes
79+
length of filename: 40 characters
80+
length of extra field: 0 bytes
81+
length of file comment: 162 characters
82+
disk number on which file begins: disk 1
83+
apparent file type: binary
84+
Unix file attributes (000600 octal): ?rw-------
85+
MS-DOS file attributes (00 hex): none
86+
87+
------------------------- file comment begins ----------------------------
88+
�PNG
89+
�
90+
-------------------------- file comment ends -----------------------------
91+
```
92+
93+
This would allow someone to hide information in the ZIP file that is not
94+
easy to extract unless the ZIP file is parsed in a particular way (and not
95+
with regular unpacking tools).

‎ziplinter/src/snapshots/ziplinter__test__binary_comment.zip.snap‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
source: ziplinter/src/lib.rs
3+
expression: result
4+
---
5+
{
6+
"comment": "",
7+
"contents": [
8+
{
9+
"central": {
10+
"comment": "ëPNG\r\n\u001a\n\u0000\u0000\u0000\rIHDR\u0000\u0000\u0000(\u0000\u0000\u0000(\b\u0002\u0000\u0000\u0000\u0003£/:\u0000\u0000\u0000iIDATX├φ╓▒\r└ \fDQêÿäé)2>Sñ`\u0015╙E)\u0002æ░eèⁿ\u001bα₧l╣p\u0014æ░#G╪\u0014`````αaÆ'vµ╦\u0003~2╞\u0013╧½╡½╓┤ÅR[I\u000e^mσcΓe∞╡┌∞¬\u0017┌U░¡w'≥▐\u0002\u0003\u0003\u0003\u0003\u0003 \u0017εΩí\u0016æïîó─\u0000\u0000\u0000\u0000IEND«B`é",
11+
"compressed_size": 10,
12+
"crc32": 4044738111,
13+
"creator_version": {
14+
"host_system": "Unix",
15+
"version": 20
16+
},
17+
"disk_nbr_start": 0,
18+
"external_attrs": 25165824,
19+
"extra": [],
20+
"flags": 0,
21+
"header_offset": 0,
22+
"internal_attrs": 0,
23+
"method": "Store",
24+
"mode": 384,
25+
"modified": "1980-01-01T00:00:00Z",
26+
"name": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
27+
"reader_version": {
28+
"host_system": "MsDos",
29+
"version": 20
30+
},
31+
"uncompressed_size": 10
32+
},
33+
"local": {
34+
"accessed": null,
35+
"compressed_size": 10,
36+
"crc32": 4044738111,
37+
"created": null,
38+
"extra": [],
39+
"flags": 0,
40+
"gid": null,
41+
"header_offset": 0,
42+
"method": "Store",
43+
"method_specific": "None",
44+
"mode": 0,
45+
"modified": "1980-01-01T00:00:00Z",
46+
"name": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
47+
"reader_version": {
48+
"host_system": "MsDos",
49+
"version": 20
50+
},
51+
"uid": null,
52+
"uncompressed_size": 10
53+
}
54+
}
55+
],
56+
"encoding": "Cp437",
57+
"eocd": {
58+
"dir": {
59+
"inner": {
60+
"dir_disk_nbr": 0,
61+
"dir_records_this_disk": 1,
62+
"directory_offset": 80,
63+
"directory_records": 1,
64+
"directory_size": 248,
65+
"disk_nbr": 0
66+
},
67+
"offset": 328
68+
},
69+
"dir64": null,
70+
"global_offset": 0
71+
},
72+
"parsed_ranges": [
73+
{
74+
"contains": "end of central directory record",
75+
"end": 350,
76+
"start": 328
77+
},
78+
{
79+
"contains": "central directory header",
80+
"end": 328,
81+
"start": 80
82+
},
83+
{
84+
"contains": "local file header",
85+
"end": 70,
86+
"filename": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
87+
"start": 0
88+
},
89+
{
90+
"contains": "file data",
91+
"end": 80,
92+
"filename": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
93+
"start": 70
94+
}
95+
],
96+
"size": 350
97+
}

0 commit comments

Comments
 (0)