archive_worker.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include <algorithm>
#include <cctype>
#include <cstdint>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <string>
#include <vector>
 
namespace fs = std::filesystem;
 
namespace {
 
struct ZipEntryInfo {
    std::string name;
    uint16_t method = 0;
    uint32_t compressed_size = 0;
    uint32_t uncompressed_size = 0;
    uint32_t local_header_offset = 0;
    std::uint64_t data_offset = 0;
    std::uint64_t data_end = 0;
};
 
constexpr uint32_t SIG_LOCAL_FILE_HEADER   = 0x04034b50;
constexpr uint32_t SIG_CENTRAL_DIR_HEADER  = 0x02014b50;
constexpr uint32_t SIG_END_OF_CENTRAL_DIR  = 0x06054b50;
 
uint16_t read_u16_le(std::ifstream& f) {
    unsigned char b[2] = {0, 0};
    f.read(reinterpret_cast<char*>(b), 2);
    return static_cast<uint16_t>(b[0] | (b[1] << 8));
}
 
uint32_t read_u32_le(std::ifstream& f) {
    unsigned char b[4] = {0, 0, 0, 0};
    f.read(reinterpret_cast<char*>(b), 4);
    return static_cast<uint32_t>(
        static_cast<uint32_t>(b[0]) |
        (static_cast<uint32_t>(b[1]) << 8) |
        (static_cast<uint32_t>(b[2]) << 16) |
        (static_cast<uint32_t>(b[3]) << 24)
    );
}
 
bool read_exact(std::ifstream& f, char* buf, std::size_t len) {
    f.read(buf, static_cast<std::streamsize>(len));
    return static_cast<std::size_t>(f.gcount()) == len;
}
 
std::string read_string(std::ifstream& f, std::size_t len) {
    std::string s(len, '\0');
    if (!len) {
        return s;
    }
    f.read(&s[0], static_cast<std::streamsize>(len));
    if (static_cast<std::size_t>(f.gcount()) != len) {
        return {};
    }
    return s;
}
 
bool contains_dotdot_path(const std::string& name) {
    if (name.find("..") == std::string::npos) {
        return false;
    }
    return name.find("../") != std::string::npos ||
           name.find("..\\") != std::string::npos ||
           name == "..";
}
 
bool is_absolute_or_weird_path(const std::string& name) {
    if (name.empty()) {
        return false;
    }
    if (name[0] == '/' || name[0] == '\\') {
        return true;
    }
    if (name.size() >= 2 && std::isalpha(static_cast<unsigned char>(name[0])) && name[1] == ':') {
        return true;
    }
    return false;
}
 
bool looks_like_nested_archive_name(const std::string& name) {
    std::string lower = name;
    std::transform(lower.begin(), lower.end(), lower.begin(),
        [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
 
    return lower.ends_with(".zip") ||
           lower.ends_with(".7z") ||
           lower.ends_with(".rar") ||
           lower.ends_with(".tar") ||
           lower.ends_with(".gz") ||
           lower.ends_with(".tgz") ||
           lower.ends_with(".bz2") ||
           lower.ends_with(".xz");
}
 
void print_json_bool(const char* key, bool value, bool comma = true) {
    std::cout << "\"" << key << "\":" << (value ? "true" : "false");
    if (comma) {
        std::cout << ",";
    }
}
 
void print_json_int(const char* key, int value, bool comma = true) {
    std::cout << "\"" << key << "\":" << value;
    if (comma) {
        std::cout << ",";
    }
}
 
void print_json_str(const char* key, const std::string& value, bool comma = true) {
    std::cout << "\"" << key << "\":\"";
    for (const char c : value) {
        if (c == '"' || c == '\\') {
            std::cout << '\\';
        }
        std::cout << c;
    }
    std::cout << "\"";
    if (comma) {
        std::cout << ",";
    }
}
 
bool find_eocd(std::ifstream& f, std::uint64_t file_size, std::uint64_t& eocd_offset) {
    if (file_size < 22) {
        return false;
    }
 
    const std::uint64_t max_comment = 65535;
    const std::uint64_t window = std::min<std::uint64_t>(file_size, 22 + max_comment);
    const std::uint64_t start = file_size - window;
 
    f.seekg(static_cast<std::streamoff>(start), std::ios::beg);
    std::vector<char> buf(static_cast<std::size_t>(window));
    if (!buf.empty()) {
        f.read(buf.data(), static_cast<std::streamsize>(buf.size()));
        if (static_cast<std::size_t>(f.gcount()) != buf.size()) {
            return false;
        }
    }
 
    for (std::int64_t i = static_cast<std::int64_t>(buf.size()) - 4; i >= 0; --i) {
        const unsigned char* p =
            reinterpret_cast<const unsigned char*>(buf.data() + i);
        const uint32_t sig =
            static_cast<uint32_t>(p[0]) |
            (static_cast<uint32_t>(p[1]) << 8) |
            (static_cast<uint32_t>(p[2]) << 16) |
            (static_cast<uint32_t>(p[3]) << 24);
 
        if (sig == SIG_END_OF_CENTRAL_DIR) {
            eocd_offset = start + static_cast<std::uint64_t>(i);
            return true;
        }
    }
 
    return false;
}
 
// Cerca un extra field ZIP64 (header ID 0x0001) e legge comp/uncomp size a 64 bit
// se i campi "legacy" valgono 0xFFFFFFFF. Ritorna true se ha trovato il blocco ZIP64.
// I valori a 64 bit aggiornano *out_comp / *out_uncomp soltanto se erano sentinella.
bool parse_zip64_extra(
    const std::vector<unsigned char>& extra,
    bool uncomp_is_sentinel,
    bool comp_is_sentinel,
    bool offset_is_sentinel,
    std::uint64_t* out_uncomp,
    std::uint64_t* out_comp,
    std::uint64_t* out_offset)
{
    std::size_t i = 0;
    while (i + 4 <= extra.size()) {
        const uint16_t hid = static_cast<uint16_t>(extra[i] | (extra[i + 1] << 8));
        const uint16_t hlen = static_cast<uint16_t>(extra[i + 2] | (extra[i + 3] << 8));
        i += 4;
        if (i + hlen > extra.size()) {
            return false;
        }
        if (hid == 0x0001) {
            std::size_t j = i;
            auto read_u64 = [&](std::uint64_t& dst) {
                if (j + 8 > i + hlen) return false;
                std::uint64_t v = 0;
                for (int k = 0; k < 8; ++k) {
                    v |= static_cast<std::uint64_t>(extra[j + k]) << (8 * k);
                }
                dst = v;
                j += 8;
                return true;
            };
            // Ordine: Uncompressed, Compressed, LocalHeaderOffset, DiskStart.
            // Solo i campi "sentinella" sono presenti.
            if (uncomp_is_sentinel && out_uncomp) {
                if (!read_u64(*out_uncomp)) return true;
            }
            if (comp_is_sentinel && out_comp) {
                if (!read_u64(*out_comp)) return true;
            }
            if (offset_is_sentinel && out_offset) {
                if (!read_u64(*out_offset)) return true;
            }
            return true;
        }
        i += hlen;
    }
    return false;
}
 
bool read_local_entry(
    std::ifstream& f,
    std::uint64_t file_size,
    std::uint64_t local_offset,
    uint16_t& method,
    uint32_t& compressed_size,
    uint32_t& uncompressed_size,
    uint16_t& gp_flags_out,
    std::string& filename,
    std::uint64_t& data_offset,
    std::uint64_t& data_end,
    std::uint64_t& zip64_comp_size,
    std::uint64_t& zip64_uncomp_size,
    bool& has_zip64_extra)
{
    zip64_comp_size = 0;
    zip64_uncomp_size = 0;
    has_zip64_extra = false;
 
    if (local_offset + 30 > file_size) {
        return false;
    }
 
    f.seekg(static_cast<std::streamoff>(local_offset), std::ios::beg);
    const uint32_t sig = read_u32_le(f);
    if (sig != SIG_LOCAL_FILE_HEADER) {
        return false;
    }
 
    (void)read_u16_le(f);      // version needed
    const uint16_t gp_flags = read_u16_le(f);
    gp_flags_out = gp_flags;
    method = read_u16_le(f);
    (void)read_u16_le(f);      // time
    (void)read_u16_le(f);      // date
    (void)read_u32_le(f);      // crc
    compressed_size = read_u32_le(f);
    uncompressed_size = read_u32_le(f);
    const uint16_t name_len = read_u16_le(f);
    const uint16_t extra_len = read_u16_le(f);
 
    filename = read_string(f, name_len);
    if (filename.size() != name_len) {
        return false;
    }
 
    std::vector<unsigned char> extra(extra_len);
    if (extra_len > 0) {
        f.read(reinterpret_cast<char*>(extra.data()), extra_len);
        if (static_cast<std::size_t>(f.gcount()) != extra_len) {
            return false;
        }
    }
 
    // ZIP64: se comp/uncomp size == 0xFFFFFFFF, i valori veri stanno nell'extra field 0x0001.
    const bool comp_is_sentinel = (compressed_size == 0xFFFFFFFFu);
    const bool uncomp_is_sentinel = (uncompressed_size == 0xFFFFFFFFu);
 
    if (comp_is_sentinel || uncomp_is_sentinel) {
        has_zip64_extra = parse_zip64_extra(
            extra,
            uncomp_is_sentinel,
            comp_is_sentinel,
            /*offset_is_sentinel=*/false,
            &zip64_uncomp_size,
            &zip64_comp_size,
            nullptr);
    }
 
    data_offset = local_offset + 30ULL + name_len + extra_len;
 
    // Dimensione affidabile per controllare se i dati escono dal file:
    //  - ZIP64 con extra valido  → usa zip64_comp_size
    //  - data descriptor (bit 3) → non nota qui: usa 0 (bypassa il check di overflow)
    //  - altrimenti              → compressed_size
    const bool has_data_descriptor = (gp_flags & 0x08) != 0;
    std::uint64_t effective_comp = compressed_size;
    if (comp_is_sentinel && has_zip64_extra) {
        effective_comp = zip64_comp_size;
    } else if (has_data_descriptor && compressed_size == 0) {
        // Dati con data descriptor: la dimensione vera sta dopo i dati, skippiamo il check.
        effective_comp = 0;
    }
 
    data_end = data_offset + effective_comp;
    if (data_offset > file_size || data_end > file_size) {
        return false;
    }
 
    return true;
}
 
} // namespace
 
int main(int argc, char** argv) {
    if (argc != 2) {
        std::cerr << "usage: archive_worker <archive-path>\n";
        return 2;
    }
 
    const fs::path path(argv[1]);
 
    bool is_zip = false;
    bool stored_size_mismatch = false;
    bool header_mismatch = false;
    bool invalid_offset = false;
    bool overlapping_entries = false;
    bool nested_archive = false;
 
    int risk_score = 0;
    std::string risk = "CLEAN";
    std::string reason_code;
    std::string detail;
 
    std::ifstream f(path, std::ios::binary);
    if (!f) {
        std::cerr << "cannot open file\n";
        return 3;
    }
 
    f.seekg(0, std::ios::end);
    const std::uint64_t file_size = static_cast<std::uint64_t>(f.tellg());
    if (file_size < 4) {
        std::cout << "{";
        print_json_bool("is_zip", false);
        print_json_bool("stored_size_mismatch", false);
        print_json_bool("header_mismatch", false);
        print_json_bool("invalid_offset", false);
        print_json_bool("overlapping_entries", false);
        print_json_bool("nested_archive", false);
        print_json_int("risk_score", 0);
        print_json_str("risk", "CLEAN");
        print_json_str("reason_code", "");
        print_json_str("detail", "", false);
        std::cout << "}\n";
        return 0;
    }
 
    f.seekg(0, std::ios::beg);
    const uint32_t first_sig = read_u32_le(f);
    if (first_sig != SIG_LOCAL_FILE_HEADER) {
        std::cout << "{";
        print_json_bool("is_zip", false);
        print_json_bool("stored_size_mismatch", false);
        print_json_bool("header_mismatch", false);
        print_json_bool("invalid_offset", false);
        print_json_bool("overlapping_entries", false);
        print_json_bool("nested_archive", false);
        print_json_int("risk_score", 0);
        print_json_str("risk", "CLEAN");
        print_json_str("reason_code", "");
        print_json_str("detail", "", false);
        std::cout << "}\n";
        return 0;
    }
 
    is_zip = true;
 
    std::uint64_t eocd_offset = 0;
    if (!find_eocd(f, file_size, eocd_offset)) {
        risk_score += 30;
        risk = "MALFORMED";
        reason_code = "ZIP_EOCD_NOT_FOUND";
        detail = "end of central directory not found";
    } else {
        f.seekg(static_cast<std::streamoff>(eocd_offset), std::ios::beg);
        const uint32_t eocd_sig = read_u32_le(f);
        if (eocd_sig != SIG_END_OF_CENTRAL_DIR) {
            risk_score += 30;
            risk = "MALFORMED";
            reason_code = "ZIP_EOCD_INVALID";
            detail = "invalid end of central directory signature";
        } else {
            (void)read_u16_le(f); // disk number
            (void)read_u16_le(f); // cd start disk
            const uint16_t entries_this_disk = read_u16_le(f);
            const uint16_t total_entries = read_u16_le(f);
            const uint32_t cd_size = read_u32_le(f);
            const uint32_t cd_offset = read_u32_le(f);
            (void)read_u16_le(f); // comment len
 
            if (entries_this_disk != total_entries) {
                header_mismatch = true;
                risk_score += 15;
            }
 
            if (static_cast<std::uint64_t>(cd_offset) + cd_size > file_size) {
                invalid_offset = true;
                risk_score += 45;
                reason_code = "ZIP_INVALID_OFFSET";
                detail = "central directory outside file";
            } else {
                std::vector<ZipEntryInfo> entries;
                entries.reserve(total_entries);
 
                std::uint64_t pos = cd_offset;
                for (uint16_t i = 0; i < total_entries; ++i) {
                    if (pos + 46 > file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "central directory header outside file";
                        }
                        break;
                    }
 
                    f.seekg(static_cast<std::streamoff>(pos), std::ios::beg);
                    const uint32_t cd_sig = read_u32_le(f);
                    if (cd_sig != SIG_CENTRAL_DIR_HEADER) {
                        header_mismatch = true;
                        risk_score += 35;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_HEADER_MISMATCH";
                            detail = "central directory signature mismatch";
                        }
                        break;
                    }
 
                    (void)read_u16_le(f); // version made by
                    (void)read_u16_le(f); // version needed
                    const uint16_t cd_gp_flags = read_u16_le(f);
                    const uint16_t cd_method = read_u16_le(f);
                    (void)read_u16_le(f); // time
                    (void)read_u16_le(f); // date
                    (void)read_u32_le(f); // crc32
                    const uint32_t cd_comp_size = read_u32_le(f);
                    const uint32_t cd_uncomp_size = read_u32_le(f);
                    const uint16_t name_len = read_u16_le(f);
                    const uint16_t extra_len = read_u16_le(f);
                    const uint16_t comment_len = read_u16_le(f);
                    (void)read_u16_le(f); // disk start
                    (void)read_u16_le(f); // int attrs
                    (void)read_u32_le(f); // ext attrs
                    const uint32_t local_header_offset_32 = read_u32_le(f);
 
                    std::string cd_name = read_string(f, name_len);
                    if (cd_name.size() != name_len) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "cannot read central directory filename";
                        }
                        break;
                    }
 
                    // Leggi extra field della central directory (può contenere ZIP64 ext)
                    std::vector<unsigned char> cd_extra(extra_len);
                    if (extra_len > 0) {
                        f.read(reinterpret_cast<char*>(cd_extra.data()), extra_len);
                        if (static_cast<std::size_t>(f.gcount()) != extra_len) {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "cannot read central directory extra field";
                            }
                            break;
                        }
                    }
 
                    // ZIP64: se comp/uncomp/offset valgono 0xFFFFFFFF, il vero valore
                    // sta nell'extra field 0x0001.
                    const bool cd_comp_is_sentinel   = (cd_comp_size == 0xFFFFFFFFu);
                    const bool cd_uncomp_is_sentinel = (cd_uncomp_size == 0xFFFFFFFFu);
                    const bool cd_off_is_sentinel    = (local_header_offset_32 == 0xFFFFFFFFu);
 
                    std::uint64_t cd_comp_size_64   = cd_comp_size;
                    std::uint64_t cd_uncomp_size_64 = cd_uncomp_size;
                    std::uint64_t local_header_offset = local_header_offset_32;
                    bool cd_has_zip64_extra = false;
                    if (cd_comp_is_sentinel || cd_uncomp_is_sentinel || cd_off_is_sentinel) {
                        cd_has_zip64_extra = parse_zip64_extra(
                            cd_extra,
                            cd_uncomp_is_sentinel,
                            cd_comp_is_sentinel,
                            cd_off_is_sentinel,
                            cd_uncomp_is_sentinel ? &cd_uncomp_size_64 : nullptr,
                            cd_comp_is_sentinel ? &cd_comp_size_64 : nullptr,
                            cd_off_is_sentinel ? &local_header_offset : nullptr);
 
                        // Se il local header offset era sentinel ma non troviamo l'extra
                        // field, il file è davvero malformato.
                        if (cd_off_is_sentinel && !cd_has_zip64_extra) {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "missing ZIP64 extra field for local header offset";
                            }
                        }
                    }
 
                    if (contains_dotdot_path(cd_name) || is_absolute_or_weird_path(cd_name)) {
                        // Segnale FORTE: un file legittimo non ha mai "../" o path
                        // assoluti nel nome. Zip-slip classico.
                        header_mismatch = true;
                        risk_score += 40;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_PATH_TRAVERSAL_NAME";
                            detail = "suspicious path inside archive";
                        }
                    }
 
                    if (looks_like_nested_archive_name(cd_name)) {
                        nested_archive = true;
                    }
 
                    if (local_header_offset >= file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "local header offset outside file";
                        }
                    } else {
                        uint16_t local_method = 0;
                        uint32_t local_comp_size = 0;
                        uint32_t local_uncomp_size = 0;
                        uint16_t local_gp_flags = 0;
                        std::string local_name;
                        std::uint64_t data_offset = 0;
                        std::uint64_t data_end = 0;
                        std::uint64_t local_zip64_comp = 0;
                        std::uint64_t local_zip64_uncomp = 0;
                        bool local_has_zip64_extra = false;
 
                        if (!read_local_entry(
                                f,
                                file_size,
                                local_header_offset,
                                local_method,
                                local_comp_size,
                                local_uncomp_size,
                                local_gp_flags,
                                local_name,
                                data_offset,
                                data_end,
                                local_zip64_comp,
                                local_zip64_uncomp,
                                local_has_zip64_extra))
                        {
                            invalid_offset = true;
                            risk_score += 45;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_INVALID_OFFSET";
                                detail = "invalid local header";
                            }
                        } else {
                            // Data descriptor (bit 3): per lo standard, i size nel
                            // local header possono essere 0 e i valori reali sono nel
                            // data descriptor dopo i dati. Non è un indizio di tampering.
                            const bool local_has_dd = (local_gp_flags & 0x08) != 0;
                            const bool cd_has_dd    = (cd_gp_flags    & 0x08) != 0;
 
                            // Calcoliamo size effettive (ZIP64-aware) per il confronto.
                            std::uint64_t eff_local_comp   = local_comp_size;
                            std::uint64_t eff_local_uncomp = local_uncomp_size;
                            if (local_comp_size == 0xFFFFFFFFu && local_has_zip64_extra) {
                                eff_local_comp = local_zip64_comp;
                            }
                            if (local_uncomp_size == 0xFFFFFFFFu && local_has_zip64_extra) {
                                eff_local_uncomp = local_zip64_uncomp;
                            }
 
                            // Le size possono essere legittimamente 0 nel local header
                            // quando c'è data descriptor: saltiamo il confronto.
                            const bool skip_size_check = local_has_dd &&
                                                         local_comp_size == 0 &&
                                                         local_uncomp_size == 0;
 
                            bool name_mismatch   = (local_name != cd_name);
                            bool method_mismatch = (local_method != cd_method);
                            bool size_mismatch   = !skip_size_check &&
                                (eff_local_comp   != cd_comp_size_64 ||
                                 eff_local_uncomp != cd_uncomp_size_64);
                            // Anche il flag data-descriptor dovrebbe combaciare; se no
                            // è un segnale debole, ma non "vero" mismatch semantico.
                            bool dd_flag_mismatch = (local_has_dd != cd_has_dd);
 
                            if (name_mismatch || method_mismatch || size_mismatch) {
                                header_mismatch = true;
                                risk_score += 35;
                                if (reason_code.empty()) {
                                    reason_code = "ZIP_HEADER_MISMATCH";
                                    detail = "local header and central directory differ";
                                }
                            } else if (dd_flag_mismatch) {
                                // Segnale debole: flag non combacia ma dati sono coerenti.
                                risk_score += 5;
                            }
 
                            // STORED-size-mismatch: un file non compresso DEVE avere
                            // compressed_size == uncompressed_size. Skip se sentinel o dd.
                            if (cd_method == 0 &&
                                !cd_comp_is_sentinel &&
                                !cd_uncomp_is_sentinel &&
                                !cd_has_dd &&
                                cd_comp_size != cd_uncomp_size)
                            {
                                stored_size_mismatch = true;
                                risk_score += 40;
                                reason_code = "ZIP_STORED_SIZE_MISMATCH";
                                detail = "STORED entry but compressed and uncompressed sizes differ";
                            }
 
                            ZipEntryInfo entry;
                            entry.name = cd_name;
                            entry.method = cd_method;
                            entry.compressed_size = cd_comp_size;
                            entry.uncompressed_size = cd_uncomp_size;
                            entry.local_header_offset =
                                static_cast<uint32_t>(local_header_offset & 0xFFFFFFFFu);
                            entry.data_offset = data_offset;
                            // Usa size ZIP64-corretta; con data descriptor non
                            // conosciamo la dimensione esatta lato local header,
                            // quindi usiamo la central directory (affidabile).
                            entry.data_end = data_offset + cd_comp_size_64;
                            entries.push_back(std::move(entry));
                        }
                    }
 
                    pos += 46ULL + name_len + extra_len + comment_len;
                    if (pos > file_size) {
                        invalid_offset = true;
                        risk_score += 45;
                        if (reason_code.empty()) {
                            reason_code = "ZIP_INVALID_OFFSET";
                            detail = "central directory entry overflow";
                        }
                        break;
                    }
                }
 
                if (!entries.empty()) {
                    std::sort(entries.begin(), entries.end(),
                        [](const ZipEntryInfo& a, const ZipEntryInfo& b) {
                            return a.data_offset < b.data_offset;
                        });
 
                    for (std::size_t i = 1; i < entries.size(); ++i) {
                        if (entries[i].data_offset < entries[i - 1].data_end) {
                            overlapping_entries = true;
                            risk_score += 50;
                            if (reason_code.empty()) {
                                reason_code = "ZIP_OVERLAPPING_ENTRIES";
                                detail = "overlapping archive entries detected";
                            }
                            break;
                        }
                    }
                }
 
                if (nested_archive) {
                    // Segnale molto debole: JAR, AAB, installer, archivi di backup,
                    // bundle di distribuzione spesso contengono archivi annidati.
                    // Da solo non deve scattare SUSPICIOUS.
                    risk_score += 5;
                    if (reason_code.empty()) {
                        reason_code = "ZIP_NESTED_ARCHIVE";
                        detail = "nested archive detected";
                    }
                }
            }
        }
    }
 
    // Soglie:
    //  - risk >= 60 → EVASIVE (più segnali forti, o uno forte + correlati)
    //  - risk >= 30 → SUSPICIOUS (un segnale forte tipo header_mismatch o stored_size_mismatch)
    //  - altrimenti → CLEAN (anche con segnali molto deboli come un nested archive isolato)
    // Se nel processo è già stato impostato "MALFORMED" (EOCD non trovato), preserviamolo.
    if (risk == "MALFORMED") {
        // no-op: preserva MALFORMED
    } else if (risk_score >= 60) {
        risk = "EVASIVE";
    } else if (risk_score >= 30) {
        risk = "SUSPICIOUS";
    } else {
        risk = "CLEAN";
    }
 
    std::cout << "{";
    print_json_bool("is_zip", is_zip);
    print_json_bool("stored_size_mismatch", stored_size_mismatch);
    print_json_bool("header_mismatch", header_mismatch);
    print_json_bool("invalid_offset", invalid_offset);
    print_json_bool("overlapping_entries", overlapping_entries);
    print_json_bool("nested_archive", nested_archive);
    print_json_int("risk_score", risk_score);
    print_json_str("risk", risk);
    print_json_str("reason_code", reason_code);
    print_json_str("detail", detail, false);
    std::cout << "}\n";
 
    return 0;
}