archive_worker.cpp File Reference

Go to the source code of this file.

Classes
struct	anonymous_namespace{archive_worker.cpp}::ZipEntryInfo

Namespaces
namespace	anonymous_namespace{archive_worker.cpp}

Functions
uint16_t	anonymous_namespace{archive_worker.cpp}::read_u16_le (std::ifstream &f)
uint32_t	anonymous_namespace{archive_worker.cpp}::read_u32_le (std::ifstream &f)
bool	anonymous_namespace{archive_worker.cpp}::read_exact (std::ifstream &f, char *buf, std::size_t len)
std::string	anonymous_namespace{archive_worker.cpp}::read_string (std::ifstream &f, std::size_t len)
bool	anonymous_namespace{archive_worker.cpp}::contains_dotdot_path (const std::string &name)
bool	anonymous_namespace{archive_worker.cpp}::is_absolute_or_weird_path (const std::string &name)
bool	anonymous_namespace{archive_worker.cpp}::looks_like_nested_archive_name (const std::string &name)
void	anonymous_namespace{archive_worker.cpp}::print_json_bool (const char *key, bool value, bool comma=true)
void	anonymous_namespace{archive_worker.cpp}::print_json_int (const char *key, int value, bool comma=true)
void	anonymous_namespace{archive_worker.cpp}::print_json_str (const char *key, const std::string &value, bool comma=true)
bool	anonymous_namespace{archive_worker.cpp}::find_eocd (std::ifstream &f, std::uint64_t file_size, std::uint64_t &eocd_offset)
bool	anonymous_namespace{archive_worker.cpp}::parse_zip64_extra (const std::vector< unsigned char > &extra, bool uncomp_is_sentinel, bool comp_is_sentinel, bool offset_is_sentinel, std::uint64_t *out_uncomp, std::uint64_t *out_comp, std::uint64_t *out_offset)
bool	anonymous_namespace{archive_worker.cpp}::read_local_entry (std::ifstream &f, std::uint64_t file_size, std::uint64_t local_offset, uint16_t &method, uint32_t &compressed_size, uint32_t &uncompressed_size, uint16_t &gp_flags_out, std::string &filename, std::uint64_t &data_offset, std::uint64_t &data_end, std::uint64_t &zip64_comp_size, std::uint64_t &zip64_uncomp_size, bool &has_zip64_extra)
int	main (int argc, char **argv)

Variables
constexpr uint32_t	anonymous_namespace{archive_worker.cpp}::SIG_LOCAL_FILE_HEADER = 0x04034b50
constexpr uint32_t	anonymous_namespace{archive_worker.cpp}::SIG_CENTRAL_DIR_HEADER = 0x02014b50
constexpr uint32_t	anonymous_namespace{archive_worker.cpp}::SIG_END_OF_CENTRAL_DIR = 0x06054b50

Function Documentation

main()

int main	(	int	argc,
		char **	argv )

Definition at line 327 of file archive_worker.cpp.

                                {
    if (argc != 2) {
        std::cerr << "usage: archive_worker <archive-path>\n";
        return 2;
    }
 
    const fs::path path(argv[1]);
 
    bool is_zip = false;
    bool stored_size_mismatch = false;
    bool header_mismatch = false;
    bool invalid_offset = false;
    bool overlapping_entries = false;
    bool nested_archive = false;
 
    int risk_score = 0;
    std::string risk = "CLEAN";
    std::string reason_code;
    std::string detail;
 
    std::ifstream f(path, std::ios::binary);
    if (!f) {
        std::cerr << "cannot open file\n";
        return 3;
    }
 
    f.seekg(0, std::ios::end);
    const std::uint64_t file_size = static_cast<std::uint64_t>(f.tellg());
    if (file_size < 4) {
        std::cout << "{";
        print_json_bool("is_zip", false);
        print_json_bool("stored_size_mismatch", false);
        print_json_bool("header_mismatch", false);
        print_json_bool("invalid_offset", false);
        print_json_bool("overlapping_entries", false);
        print_json_bool("nested_archive", false);
        print_json_int("risk_score", 0);
        print_json_str("risk", "CLEAN");
        print_json_str("reason_code", "");
        print_json_str("detail", "", false);
        std::cout << "}\n";
        return 0;
    }
 
    f.seekg(0, std::ios::beg);
    const uint32_t first_sig = read_u32_le(f);
    if (first_sig != SIG_LOCAL_FILE_HEADER) {
        std::cout << "{";
        print_json_bool("is_zip", false);
        print_json_bool("stored_size_mismatch", false);
        print_json_bool("header_mismatch", false);
        print_json_bool("invalid_offset", false);
        print_json_bool("overlapping_entries", false);
        print_json_bool("nested_archive", false);
        print_json_int("risk_score", 0);
        print_json_str("risk", "CLEAN");
        print_json_str("reason_code", "");
        print_json_str("detail", "", false);
        std::cout << "}\n";
        return 0;
    }
 
    is_zip = true;
 
    std::uint64_t eocd_offset = 0;
    if (!find_eocd(f, file_size, eocd_offset)) {
        risk_score += 30;
        risk = "MALFORMED";
        reason_code = "ZIP_EOCD_NOT_FOUND";
        detail = "end of central directory not found";
    } else {
        f.seekg(static_cast<std::streamoff>(eocd_offset), std::ios::beg);
        const uint32_t eocd_sig = read_u32_le(f);
        if (eocd_sig != SIG_END_OF_CENTRAL_DIR) {
            risk_score += 30;
            risk = "MALFORMED";
            reason_code = "ZIP_EOCD_INVALID";
            detail = "invalid end of central directory signature";
        } else {
            (void)read_u16_le(f); // disk number
            (void)read_u16_le(f); // cd start disk
            const uint16_t entries_this_disk = read_u16_le(f);
            const uint16_t total_entries = read_u16_le(f);
            const uint32_t cd_size = read_u32_le(f);
            const uint32_t cd_offset = read_u32_le(f);
            (void)read_u16_le(f); // comment len
 
            if (entries_this_disk != total_entries) {
                header_mismatch = true;
                risk_score += 15;
            }
 
            if (static_cast<std::uint64_t>(cd_offset) + cd_size > file_size) {
                invalid_offset = true;
                risk_score += 45;
                reason_code = "ZIP_INVALID_OFFSET";
                detail = "central directory outside file";
            } else {
                std::vector<ZipEntryInfo> entries;
                entries.reserve(total_entries);
 
                std::uint64_t pos = cd_offset;
                for (uint16_t i = 0; i < total_entries; ++i) {
                    if (pos + 46 > file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "central directory header outside file";
                        }
                        break;
                    }
 
                    f.seekg(static_cast<std::streamoff>(pos), std::ios::beg);
                    const uint32_t cd_sig = read_u32_le(f);
                    if (cd_sig != SIG_CENTRAL_DIR_HEADER) {
                        header_mismatch = true;
                        risk_score += 35;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_HEADER_MISMATCH";
                            detail = "central directory signature mismatch";
                        }
                        break;
                    }
 
                    (void)read_u16_le(f); // version made by
                    (void)read_u16_le(f); // version needed
                    const uint16_t cd_gp_flags = read_u16_le(f);
                    const uint16_t cd_method = read_u16_le(f);
                    (void)read_u16_le(f); // time
                    (void)read_u16_le(f); // date
                    (void)read_u32_le(f); // crc32
                    const uint32_t cd_comp_size = read_u32_le(f);
                    const uint32_t cd_uncomp_size = read_u32_le(f);
                    const uint16_t name_len = read_u16_le(f);
                    const uint16_t extra_len = read_u16_le(f);
                    const uint16_t comment_len = read_u16_le(f);
                    (void)read_u16_le(f); // disk start
                    (void)read_u16_le(f); // int attrs
                    (void)read_u32_le(f); // ext attrs
                    const uint32_t local_header_offset_32 = read_u32_le(f);
 
                    std::string cd_name = read_string(f, name_len);
                    if (cd_name.size() != name_len) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "cannot read central directory filename";
                        }
                        break;
                    }
 
                    // Leggi extra field della central directory (può contenere ZIP64 ext)
                    std::vector<unsigned char> cd_extra(extra_len);
                    if (extra_len > 0) {
                        f.read(reinterpret_cast<char*>(cd_extra.data()), extra_len);
                        if (static_cast<std::size_t>(f.gcount()) != extra_len) {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "cannot read central directory extra field";
                            }
                            break;
                        }
                    }
 
                    // ZIP64: se comp/uncomp/offset valgono 0xFFFFFFFF, il vero valore
                    // sta nell'extra field 0x0001.
                    const bool cd_comp_is_sentinel   = (cd_comp_size == 0xFFFFFFFFu);
                    const bool cd_uncomp_is_sentinel = (cd_uncomp_size == 0xFFFFFFFFu);
                    const bool cd_off_is_sentinel    = (local_header_offset_32 == 0xFFFFFFFFu);
 
                    std::uint64_t cd_comp_size_64   = cd_comp_size;
                    std::uint64_t cd_uncomp_size_64 = cd_uncomp_size;
                    std::uint64_t local_header_offset = local_header_offset_32;
                    bool cd_has_zip64_extra = false;
                    if (cd_comp_is_sentinel || cd_uncomp_is_sentinel || cd_off_is_sentinel) {
                        cd_has_zip64_extra = parse_zip64_extra(
                            cd_extra,
                            cd_uncomp_is_sentinel,
                            cd_comp_is_sentinel,
                            cd_off_is_sentinel,
                            cd_uncomp_is_sentinel ? &cd_uncomp_size_64 : nullptr,
                            cd_comp_is_sentinel ? &cd_comp_size_64 : nullptr,
                            cd_off_is_sentinel ? &local_header_offset : nullptr);
 
                        // Se il local header offset era sentinel ma non troviamo l'extra
                        // field, il file è davvero malformato.
                        if (cd_off_is_sentinel && !cd_has_zip64_extra) {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "missing ZIP64 extra field for local header offset";
                            }
                        }
                    }
 
                    if (contains_dotdot_path(cd_name) || is_absolute_or_weird_path(cd_name)) {
                        // Segnale FORTE: un file legittimo non ha mai "../" o path
                        // assoluti nel nome. Zip-slip classico.
                        header_mismatch = true;
                        risk_score += 40;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_PATH_TRAVERSAL_NAME";
                            detail = "suspicious path inside archive";
                        }
                    }
 
                    if (looks_like_nested_archive_name(cd_name)) {
                        nested_archive = true;
                    }
 
                    if (local_header_offset >= file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "local header offset outside file";
                        }
                    } else {
                        uint16_t local_method = 0;
                        uint32_t local_comp_size = 0;
                        uint32_t local_uncomp_size = 0;
                        uint16_t local_gp_flags = 0;
                        std::string local_name;
                        std::uint64_t data_offset = 0;
                        std::uint64_t data_end = 0;
                        std::uint64_t local_zip64_comp = 0;
                        std::uint64_t local_zip64_uncomp = 0;
                        bool local_has_zip64_extra = false;
 
                        if (!read_local_entry(
                                f,
                                file_size,
                                local_header_offset,
                                local_method,
                                local_comp_size,
                                local_uncomp_size,
                                local_gp_flags,
                                local_name,
                                data_offset,
                                data_end,
                                local_zip64_comp,
                                local_zip64_uncomp,
                                local_has_zip64_extra))
                        {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "invalid local header";
                            }
                        } else {
                            // Data descriptor (bit 3): per lo standard, i size nel
                            // local header possono essere 0 e i valori reali sono nel
                            // data descriptor dopo i dati. Non è un indizio di tampering.
                            const bool local_has_dd = (local_gp_flags & 0x08) != 0;
                            const bool cd_has_dd    = (cd_gp_flags    & 0x08) != 0;
 
                            // Calcoliamo size effettive (ZIP64-aware) per il confronto.
                            std::uint64_t eff_local_comp   = local_comp_size;
                            std::uint64_t eff_local_uncomp = local_uncomp_size;
                            if (local_comp_size == 0xFFFFFFFFu && local_has_zip64_extra) {
                                eff_local_comp = local_zip64_comp;
                            }
                            if (local_uncomp_size == 0xFFFFFFFFu && local_has_zip64_extra) {
                                eff_local_uncomp = local_zip64_uncomp;
                            }
 
                            // Le size possono essere legittimamente 0 nel local header
                            // quando c'è data descriptor: saltiamo il confronto.
                            const bool skip_size_check = local_has_dd &&
                                                         local_comp_size == 0 &&
                                                         local_uncomp_size == 0;
 
                            bool name_mismatch   = (local_name != cd_name);
                            bool method_mismatch = (local_method != cd_method);
                            bool size_mismatch   = !skip_size_check &&
                                (eff_local_comp   != cd_comp_size_64 ||
                                 eff_local_uncomp != cd_uncomp_size_64);
                            // Anche il flag data-descriptor dovrebbe combaciare; se no
                            // è un segnale debole, ma non "vero" mismatch semantico.
                            bool dd_flag_mismatch = (local_has_dd != cd_has_dd);
 
                            if (name_mismatch || method_mismatch || size_mismatch) {
                                header_mismatch = true;
                                risk_score += 35;
                                if (reason_code.empty()) {
                                    reason_code = "ZIP_HEADER_MISMATCH";
                                    detail = "local header and central directory differ";
                                }
                            } else if (dd_flag_mismatch) {
                                // Segnale debole: flag non combacia ma dati sono coerenti.
                                risk_score += 5;
                            }
 
                            // STORED-size-mismatch: un file non compresso DEVE avere
                            // compressed_size == uncompressed_size. Skip se sentinel o dd.
                            if (cd_method == 0 &&
                                !cd_comp_is_sentinel &&
                                !cd_uncomp_is_sentinel &&
                                !cd_has_dd &&
                                cd_comp_size != cd_uncomp_size)
                            {
                                stored_size_mismatch = true;
                                risk_score += 40;
                                reason_code = "ZIP_STORED_SIZE_MISMATCH";
                                detail = "STORED entry but compressed and uncompressed sizes differ";
                            }
 
                            ZipEntryInfo entry;
                            entry.name = cd_name;
                            entry.method = cd_method;
                            entry.compressed_size = cd_comp_size;
                            entry.uncompressed_size = cd_uncomp_size;
                            entry.local_header_offset =
                                static_cast<uint32_t>(local_header_offset & 0xFFFFFFFFu);
                            entry.data_offset = data_offset;
                            // Usa size ZIP64-corretta; con data descriptor non
                            // conosciamo la dimensione esatta lato local header,
                            // quindi usiamo la central directory (affidabile).
                            entry.data_end = data_offset + cd_comp_size_64;
                            entries.push_back(std::move(entry));
                        }
                    }
 
                    pos += 46ULL + name_len + extra_len + comment_len;
                    if (pos > file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "central directory entry overflow";
                        }
                        break;
                    }
                }
 
                if (!entries.empty()) {
                    std::sort(entries.begin(), entries.end(),
                        [](const ZipEntryInfo& a, const ZipEntryInfo& b) {
                            return a.data_offset < b.data_offset;
                        });
 
                    for (std::size_t i = 1; i < entries.size(); ++i) {
                        if (entries[i].data_offset < entries[i - 1].data_end) {
                            overlapping_entries = true;
                            risk_score += 50;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_OVERLAPPING_ENTRIES";
                                detail = "overlapping archive entries detected";
                            }
                            break;
                        }
                    }
                }
 
                if (nested_archive) {
                    // Segnale molto debole: JAR, AAB, installer, archivi di backup,
                    // bundle di distribuzione spesso contengono archivi annidati.
                    // Da solo non deve scattare SUSPICIOUS.
                    risk_score += 5;
                    if (reason_code.empty()) {
                        reason_code = "ZIP_NESTED_ARCHIVE";
                        detail = "nested archive detected";
                    }
                }
            }
        }
    }
 
    // Soglie:
    //  - risk >= 60 → EVASIVE (più segnali forti, o uno forte + correlati)
    //  - risk >= 30 → SUSPICIOUS (un segnale forte tipo header_mismatch o stored_size_mismatch)
    //  - altrimenti → CLEAN (anche con segnali molto deboli come un nested archive isolato)
    // Se nel processo è già stato impostato "MALFORMED" (EOCD non trovato), preserviamolo.
    if (risk == "MALFORMED") {
        // no-op: preserva MALFORMED
    } else if (risk_score >= 60) {
        risk = "EVASIVE";
    } else if (risk_score >= 30) {
        risk = "SUSPICIOUS";
    } else {
        risk = "CLEAN";
    }
 
    std::cout << "{";
    print_json_bool("is_zip", is_zip);
    print_json_bool("stored_size_mismatch", stored_size_mismatch);
    print_json_bool("header_mismatch", header_mismatch);
    print_json_bool("invalid_offset", invalid_offset);
    print_json_bool("overlapping_entries", overlapping_entries);
    print_json_bool("nested_archive", nested_archive);
    print_json_int("risk_score", risk_score);
    print_json_str("risk", risk);
    print_json_str("reason_code", reason_code);
    print_json_str("detail", detail, false);
    std::cout << "}\n";
 
    return 0;
}

References anonymous_namespace{archive_worker.cpp}::contains_dotdot_path(), anonymous_namespace{archive_worker.cpp}::find_eocd(), anonymous_namespace{archive_worker.cpp}::is_absolute_or_weird_path(), anonymous_namespace{archive_worker.cpp}::looks_like_nested_archive_name(), main(), anonymous_namespace{archive_worker.cpp}::parse_zip64_extra(), anonymous_namespace{archive_worker.cpp}::print_json_bool(), anonymous_namespace{archive_worker.cpp}::print_json_int(), anonymous_namespace{archive_worker.cpp}::print_json_str(), anonymous_namespace{archive_worker.cpp}::read_local_entry(), anonymous_namespace{archive_worker.cpp}::read_string(), anonymous_namespace{archive_worker.cpp}::read_u16_le(), anonymous_namespace{archive_worker.cpp}::read_u32_le(), anonymous_namespace{archive_worker.cpp}::SIG_CENTRAL_DIR_HEADER, anonymous_namespace{archive_worker.cpp}::SIG_END_OF_CENTRAL_DIR, and anonymous_namespace{archive_worker.cpp}::SIG_LOCAL_FILE_HEADER.