/*
* Copyright 2018 LinkedIn Corp.
*
* Licensed under the Apache License, Version 2.0 (the “License”); you may not
* use this file except in compliance with the License. You may obtain a copy of
* the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an “AS IS” BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations under
* the License.
*/
package azkaban.utils;

import static org.assertj.core.api.Assertions.assertThatThrownBy;

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.zip.ZipEntry;
import java.util.zip.ZipFile;
import java.util.zip.ZipOutputStream;
import org.junit.Test;

/**
 * Test class for azkaban.utils.Utils
 */
public class UtilsTest {

  /**
   * An insecure zip file may hold path traversal filenames. During unzipping, the filename gets
   * concatenated to the target directory. The final path may end up outside the target directory,
   * causing security issues.
   *
   * @throws IOException the io exception
   */
  @Test
  public void testUnzipInsecureFile() throws IOException {
    final File zipFile = new File("myTest.zip");
    try (final ZipOutputStream out = new ZipOutputStream(new FileOutputStream(zipFile))) {
      final ZipEntry entry = new ZipEntry("../../../../../evil.txt");
      out.putNextEntry(entry);
    }

    final ZipFile source = new ZipFile(zipFile);
    final File dest = Utils.createTempDir();
    assertThatThrownBy(() -> Utils.unzip(source, dest)).isInstanceOf(IOException.class)
        .hasMessageContaining("Extracting zip entry would have resulted in a file outside the "
            + "specified destination directory.");
  }
}

@@ -1338,24 +1338,36 @@
 Test.zip%22);%0A
+    try %7B%0A  
     try (fin
@@ -1447,24 +1447,26 @@
 ))) %7B%0A      
+  
 final ZipEnt
@@ -1523,16 +1523,18 @@
 ;%0A      
+ 
+ 
 out.putN
@@ -1558,11 +1558,15 @@
     
+  
 %7D%0A%0A
+  
     
@@ -1610,16 +1610,18 @@
 pFile);%0A
+  
     fina
@@ -1661,16 +1661,18 @@
 ();%0A    
+  
 assertTh
@@ -1747,16 +1747,18 @@
 .class)%0A
+  
         
@@ -1857,16 +1857,18 @@
         
+  
 + %22speci
@@ -1898,14 +1898,100 @@
 ory.%22);%0A
+    %7D finally %7B%0A      if (zipFile.exists()) %7B%0A        zipFile.delete();%0A      %7D%0A    %7D%0A
   %7D%0A%7D%0A

Clean up the zip file after the test case. (#1785)