package fs import ( "archive/zip" "fmt" "io" "os" "path/filepath" "strings" ) // Zip compresses one or many files into a single zip archive file. func Zip(zipName string, files []string, compress bool) (err error) { // Create zip file directory if it does not yet exist. if zipDir := filepath.Dir(zipName); zipDir != "" && zipDir != "." { err = os.MkdirAll(zipDir, ModeDir) if err != nil { return err } } var newZipFile *os.File if newZipFile, err = os.Create(zipName); err != nil { return err } defer newZipFile.Close() zipWriter := zip.NewWriter(newZipFile) defer zipWriter.Close() // Add files to zip archive. for _, fileName := range files { if err = ZipFile(zipWriter, fileName, "", compress); err != nil { return err } } return nil } // ZipFile adds a file to a zip archive, optionally with an alias and compression. func ZipFile(zipWriter *zip.Writer, fileName, fileAlias string, compress bool) (err error) { // Open file. fileToZip, err := os.Open(fileName) if err != nil { return err } // Close file when done. defer fileToZip.Close() // Get file information. info, err := fileToZip.Stat() if err != nil { return err } // Create file info header. header, err := zip.FileInfoHeader(info) if err != nil { return err } // Set filename alias, if any. if fileAlias != "" { header.Name = fileAlias } // Set method to deflate to enable compression, // see http://golang.org/pkg/archive/zip/#pkg-constants if compress { header.Method = zip.Deflate } else { header.Method = zip.Store } // Write file info header. writer, err := zipWriter.CreateHeader(header) if err != nil { return err } // Copy file to zip. _, err = io.Copy(writer, fileToZip) // Return error, if any. return err } // Unzip extracts the contents of a zip file to the target directory. func Unzip(zipName, dir string, fileSizeLimit, totalSizeLimit int64) (files []string, skipped []string, err error) { zipReader, err := zip.OpenReader(zipName) if err != nil { return files, skipped, err } defer zipReader.Close() for _, zipFile := range zipReader.File { // Skip directories like __OSX and potentially malicious file names containing "..". if strings.HasPrefix(zipFile.Name, "__") || strings.Contains(zipFile.Name, "..") || totalSizeLimit == 0 || fileSizeLimit > 0 && zipFile.UncompressedSize64 > uint64(fileSizeLimit) { skipped = append(skipped, zipFile.Name) continue } if totalSizeLimit < 1 { // Do nothing; } else if totalSizeLimit = totalSizeLimit - int64(zipFile.UncompressedSize64); totalSizeLimit < 1 { skipped = append(skipped, zipFile.Name) totalSizeLimit = 0 continue } fileName, unzipErr := UnzipFile(zipFile, dir) if unzipErr != nil { return files, skipped, unzipErr } files = append(files, fileName) } return files, skipped, nil } // UnzipFile writes a file from a zip archive to the target destination. func UnzipFile(f *zip.File, dir string) (fileName string, err error) { rc, err := f.Open() if err != nil { return fileName, err } defer rc.Close() // Compose destination file or directory path with safety checks. if fileName, err = safeJoin(dir, f.Name); err != nil { return fileName, err } // Create destination path if it is a directory. if f.FileInfo().IsDir() { return fileName, MkdirAll(fileName) } // If it is a file, make sure its destination directory exists. var basePath string if lastIndex := strings.LastIndex(fileName, string(os.PathSeparator)); lastIndex > -1 { basePath = fileName[:lastIndex] } if err = MkdirAll(basePath); err != nil { return fileName, err } fd, err := os.OpenFile(fileName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode()) if err != nil { return fileName, err } defer fd.Close() _, err = io.Copy(fd, rc) if err != nil { return fileName, err } return fileName, nil } // safeJoin joins a base directory with a relative name and ensures // that the resulting path stays within the base directory. Absolute // paths and Windows-style volume names are rejected. func safeJoin(baseDir, name string) (string, error) { if name == "" { return "", fmt.Errorf("invalid zip path") } if filepath.IsAbs(name) || filepath.VolumeName(name) != "" { return "", fmt.Errorf("invalid zip path: absolute or volume path not allowed") } cleaned := filepath.Clean(name) // Prevent paths that resolve outside the base dir. dest := filepath.Join(baseDir, cleaned) base := filepath.Clean(baseDir) if dest != base && !strings.HasPrefix(dest, base+string(os.PathSeparator)) { return "", fmt.Errorf("invalid zip path: outside target directory") } return dest, nil }