Class: Xlsxrb::Ooxml::ZipReader

Inherits:
Object
  • Object
show all
Defined in:
lib/xlsxrb/ooxml/zip_reader.rb,
sig/generated/xlsxrb/ooxml/zip_reader.rbs

Overview

Reads ZIP archives using only stdlib (zlib). Scans local file headers sequentially — works with non-seekable IO.

Constant Summary collapse

LOCAL_HEADER_SIG =

Returns:

  • (Object) 
"PK\x03\x04".b
MAX_UNCOMPRESSED_SIZE =

500MB per file limit

Returns:

  • (Object) 
500 * 1024 * 1024

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(io, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE) ⇒ ZipReader

: (untyped io, ?max_uncompressed_size: Integer) -> void

Parameters:

  • io (Object)
  • max_uncompressed_size: (Integer) (defaults to: MAX_UNCOMPRESSED_SIZE) 


35
36
37
38
39
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 35

def initialize(io, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE)
  @io = io
  @max_uncompressed_size = max_uncompressed_size
  @entries = nil
end

Instance Attribute Details

#max_uncompressed_size ⇒ Object

Returns the value of attribute max_uncompressed_size.

Returns:

  • (Object) 


16
17
18
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 16

def max_uncompressed_size
  @max_uncompressed_size
end

Class Method Details

.open(source, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE) ⇒ void

This method returns an undefined value.

Opens a ZIP from a file path or IO and yields the reader. : (untyped source, ?max_uncompressed_size: Integer) ?{ (ZipReader) -> untyped } -> (ZipReader | untyped)

Parameters:

  • source (Object)
  • max_uncompressed_size: (Integer) (defaults to: MAX_UNCOMPRESSED_SIZE) 


20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 20

def self.open(source, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE)
  io = source.is_a?(String) ? File.open(source, "rb") : source
  reader = new(io, max_uncompressed_size: max_uncompressed_size)
  if block_given?
    begin
      yield reader
    ensure
      io.close if source.is_a?(String)
    end
  else
    reader
  end
end

Instance Method Details

#decompress(raw, method) ⇒ Object

Parameters:

  • raw (Object)
  • method (Object)

Returns:

  • (Object) 


240
241
242
243
244
245
246
247
248
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 240

def decompress(raw, method)
  return raw&.dup&.force_encoding("UTF-8") || "" if method.zero? # stored

  # Deflated
  safe_inflate(raw || "", -Zlib::MAX_WBITS)
rescue Zlib::DataError
  # Try with raw deflate (no header)
  safe_inflate(raw || "", -Zlib::MAX_WBITS)
end

#each_entry(&block) ⇒ void

This method returns an undefined value.

Yields (entry_name, data_string) for each file in the archive.



54
55
56
57
58
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 54

def each_entry(&block)
  return enum_for(:each_entry) unless block

  entries.each_pair(&block)
end

#entries ⇒ Object

Returns:

  • (Object) 


62
63
64
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 62

def entries
  @entries ||= parse_entries
end

#find_data_descriptor_stream(io, method) ⇒ Object

Parameters:

  • io (Object)
  • method (Object)

Returns:

  • (Object) 


201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 201

def find_data_descriptor_stream(io, method)
  if method == 8
    inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS)
    result = +""
    chunk_size = 4096
    begin
      while !inflater.finished? && (chunk = io.read(chunk_size))
        break if chunk.empty?

        inflated = inflater.inflate(chunk)
        limit = @max_uncompressed_size || MAX_UNCOMPRESSED_SIZE
        raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit

        result << inflated
      end
    rescue Zlib::BufError, Zlib::DataError
      # Inflation ended
    ensure
      remaining_bytes = inflater.avail_in
      inflater.close
    end

    io.seek(-remaining_bytes, IO::SEEK_CUR) if io.respond_to?(:seek) && remaining_bytes.positive?

    desc_sig = io.read(4)
    if desc_sig == [0x50, 0x4B, 0x07, 0x08].pack("C4")
      io.read(12)
    elsif desc_sig == [0x50, 0x4B, 0x03, 0x04].pack("C4") || desc_sig == [0x50, 0x4B, 0x01, 0x02].pack("C4")
      io.seek(-4, IO::SEEK_CUR) if io.respond_to?(:seek)
    elsif desc_sig
      io.read(8)
    end

    [result, 0]
  else
    [io.read(0), 0]
  end
end

#parse_entries ⇒ Object

Returns:

  • (Object)

Raises:

  • (ArgumentError) 


66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 66

def parse_entries
  io = if @io.is_a?(StringIO) || (@io.respond_to?(:read) && @io.respond_to?(:seek) && @io.respond_to?(:pos))
         @io
       elsif @io.respond_to?(:each) || @io.is_a?(Enumerator)
         tf = Tempfile.new("xlsxrb_zip")
         tf.binmode
         @io.each { |chunk| tf.write(chunk) }
         tf.rewind
         tf
       else
         StringIO.new(@io.read.b)
       end

  io.binmode if io.respond_to?(:binmode)

  first_sig = io.read(4)
  raise ArgumentError, "Invalid magic number: Expected a valid ZIP/XLSX file format (PK\\x03\\x04)" unless first_sig == LOCAL_HEADER_SIG

  # Try parsing via Central Directory first (standard and handles Data Descriptors perfectly)
  cd_result = parse_from_central_directory(io)
  if cd_result && !cd_result.empty?
    if io.is_a?(Tempfile)
      io.close
      io.unlink
    end
    return cd_result
  end

  io.seek(-4, IO::SEEK_CUR) if io.respond_to?(:seek)
  io = StringIO.new(first_sig + io.read.b) unless io.respond_to?(:seek)

  result = {}

  loop do
    sig = io.read(4)
    break unless sig == LOCAL_HEADER_SIG

    header = io.read(26)
    break unless header && header.bytesize == 26

    gp_flag         = header[2, 2].unpack1("v")
    method          = header[4, 2].unpack1("v")
    compressed_size = header[14, 4].unpack1("V")
    name_len        = header[22, 2].unpack1("v")
    extra_len       = header[24, 2].unpack1("v")

    entry_name = io.read(name_len).force_encoding("UTF-8")
    io.read(extra_len) # skip extra

    has_data_descriptor = gp_flag.anybits?(0x08)

    if has_data_descriptor && compressed_size.zero?
      entry_data, = find_data_descriptor_stream(io, method)
    else
      raw = io.read(compressed_size)
      entry_data = decompress(raw, method)
    end
    result[entry_name] = entry_data unless entry_name.end_with?("/")
  end

  if io.is_a?(Tempfile)
    io.close
    io.unlink
  end

  result
end

#parse_from_central_directory(io) ⇒ Object

Parameters:

  • io (Object)

Returns:

  • (Object) 


134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 134

def parse_from_central_directory(io)
  return nil unless io.respond_to?(:seek) && io.respond_to?(:pos)

  io.seek(0, IO::SEEK_END)
  file_size = io.pos
  return nil if file_size < 22

  max_search = [file_size, 65_557].min
  search_offset = file_size - max_search
  io.seek(search_offset, IO::SEEK_SET)
  search_buf = io.read(max_search)
  return nil unless search_buf

  eocd_index = search_buf.rindex("PK\x05\x06")
  return nil unless eocd_index

  eocd_pos = search_offset + eocd_index
  io.seek(eocd_pos + 4, IO::SEEK_SET)
  eocd_data = io.read(18)
  return nil unless eocd_data && eocd_data.bytesize == 18

  _disk_num, _cd_disk, _disk_entries, total_entries, _cd_size, cd_offset, _comment_len = eocd_data.unpack("vvvvVVv")
  return nil if cd_offset > file_size

  io.seek(cd_offset, IO::SEEK_SET)
  result = {}

  total_entries.times do
    sig = io.read(4)
    break unless sig == "PK\x01\x02"

    cd_header = io.read(42)
    break unless cd_header && cd_header.bytesize == 42

    _v_made, _v_need, _gp, method, _time, _date, _crc, csize, _usize, nlen, elen, clen, _dnum, _iattr, _eattr, offset = cd_header.unpack("vvvvvvVVVvvvvvVV")
    entry_name = io.read(nlen).force_encoding("UTF-8")
    io.read(elen + clen)

    next if entry_name.end_with?("/")

    current_cd_pos = io.pos

    io.seek(offset, IO::SEEK_SET)
    local_sig = io.read(4)
    next unless local_sig == LOCAL_HEADER_SIG

    local_header = io.read(26)
    next unless local_header && local_header.bytesize == 26

    local_nlen = local_header[22, 2].unpack1("v")
    local_elen = local_header[24, 2].unpack1("v")
    io.seek(offset + 30 + local_nlen + local_elen, IO::SEEK_SET)

    raw = io.read(csize)
    entry_data = decompress(raw, method)
    result[entry_name] = entry_data

    io.seek(current_cd_pos, IO::SEEK_SET)
  end

  result
rescue ArgumentError => e
  raise e
rescue StandardError
  nil
end

#read_all ⇒ Object

Returns a Hash { entry_name => raw_bytes } for all entries.

Returns:

  • (Object) 


42
43
44
45
46
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 42

def read_all
  result = {}
  each_entry { |name, data| result[name] = data }
  result
end

#read_entry(name) ⇒ Object

Returns raw bytes for a single entry, or nil if not found.

Parameters:

  • name (Object)

Returns:

  • (Object) 


49
50
51
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 49

def read_entry(name)
  entries[name]
end

#safe_inflate(raw, wbits) ⇒ Object

Parameters:

  • raw (Object)
  • wbits (Object)

Returns:

  • (Object) 


250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
 
# File 'lib/xlsxrb/ooxml/zip_reader.rb', line 250

def safe_inflate(raw, wbits)
  inflater = Zlib::Inflate.new(wbits)
  result = +""
  chunk_size = 32_768
  offset = 0
  raw_len = raw.bytesize
  limit = @max_uncompressed_size || MAX_UNCOMPRESSED_SIZE

  begin
    while offset < raw_len
      chunk = raw.byteslice(offset, chunk_size)
      inflated = inflater.inflate(chunk)
      raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit

      result << inflated
      offset += chunk_size
    end
    # Finish inflation
    inflated = inflater.finish
    raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit

    result << inflated
  ensure
    inflater.close
  end

  result.force_encoding("UTF-8")
end