Package: pure-checker
@sebdroid/pure-checkerpure-checker is a Python3 port of the following npm package:@ronomon/purePure is astatic analysis file format checkerthat checks ZIP files for dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping headers, overflow, underflow, sparseness, accidental buffer bleeds etc.Pure's goal is tonarrow the semantic gap available to attackersattempting to exploit vulnerable software, and toreduce the probability of zero-days, for example David Fifield'sA better zip bomb, which wasdetected by an early version of Pure as a zero-day.AcknowledgementsPure was commissioned and sponsored by theProduct Release And Security TeamatMicrosoft.A special thanks toMaxim Vainsteinand his team at Microsoft for their vision and encouragement.Looking to the future, we want to add support for more archive containers (GZ, TAR, RAR etc.) and other file formats (MS-CFBF or OOXML Office files, RTF, PDF, image formats etc.). Please contactJoran Dirk Greefif you want to support new file formats in Pure.Filespure.h: C interface to library source code.pure: CLI script for development testing. Usage:./pure <file>.test.js: Node.js test runner to run Pure against all test files in./tests.binding.c: Node.js binding used by CLI and test runner.make-errors.js: Script to recreate C error enums, error codes and error strings dynamically.make-signatures.js: Script to recreate C signature strings dynamically.make-tests.js: Script to recreate test files dynamically.Installationnpminstall@ronomon/pureUsageAt the command line, you can run Pure on any zip file:$./pure<file.zip>For example:$./puresamples/zbsm.zip
PURE_E_ZIP_BOMB_FIFIELD:zipbomb:localfileheaderoverlap(seeresearchbyDavidFifield)As an embedded C library,pure.hprovides:intpure_zip(constuint8_t*buffer,// Zip file bufferconstuint64_tsize,// Size of zip file buffer in bytesconstuint64_tflags// Bit flags (optional))intpure_zip_bomb(constinterror)constchar*pure_error_code(constinterror)constchar*pure_error_string(constinterror)pure_zip()returns a non-zero error return code, or a zero return code if the zip file is clean and has no file format anomalies. A buffer instead of a path is passed to pure_zip() for portability, for reduced surface area for bugs, and to avoid forcing unnecessary IO if file contents are already in memory.pure_zip_bomb()returns 1 if the error return code indicates a zip bomb, otherwise 0.pure_error_code()returns the constant name of the error return code.pure_error_string()returns the error message string corresponding the error return code.File Format AnomaliesPure detectsmore than 150 zip file format anomalies.Pure provides defenses against directory and symlink traversal exploits, dangerous unix mode permissions, parser ambiguity, and many other defenses against known (and unknown) exploits, including zip bombs and buffer overflows.For example, Pure detectsall variants of known (and unknown) zip bombs:Overlapping local file headers (cf.David Fifield).Quines (cf.Russ Cox).Dangerous compression ratios for individual files and across an archive."Lying" zip metadata vs actual compressed data.Excessive archive recursion.Excessive number of files.As a static analysis file format checker, Pure reduces the surface area for zero-day exploits by orders of magnitude.If a file can get past Pure, it's "pure"... or at least 99% pure.Here is the exhaustive list of what Pure can already detect:PURE_E_SIZE_MAXPURE_E_MALLOCPURE_E_STRING_NOT_FOUNDPURE_E_UINT64_OVERFLOWPURE_E_ZIP_BOMB_ARCHIVESPURE_E_ZIP_BOMB_DEPTHPURE_E_ZIP_BOMB_FIFIELDPURE_E_ZIP_BOMB_FILESPURE_E_ZIP_BOMB_RATIOPURE_E_ZIP_BOMB_INFLATE_COMPRESSED_OVERFLOWPURE_E_ZIP_BOMB_INFLATE_UNCOMPRESSED_OVERFLOWPURE_E_ZIP_TOO_SMALLPURE_E_ZIP_SIZE_4GBPURE_E_ZIP_RARPURE_E_ZIP_TARPURE_E_ZIP_XARPURE_E_ZIP_SIGNATUREPURE_E_ZIP_EOCDR_NOT_FOUNDPURE_E_ZIP_EOCDR_OVERFLOWPURE_E_ZIP_EOCDR_COMMENT_OVERFLOWPURE_E_ZIP_EOCDR_SIGNATUREPURE_E_ZIP_EOCDR_RECORDSPURE_E_ZIP_EOCDR_SIZE_OVERFLOWPURE_E_ZIP_EOCDR_SIZE_UNDERFLOWPURE_E_ZIP_MULTIPLE_DISKSPURE_E_ZIP_APPENDED_DATA_ZEROEDPURE_E_ZIP_APPENDED_DATA_BUFFER_BLEEDPURE_E_ZIP_PREPENDED_DATAPURE_E_ZIP_PREPENDED_DATA_ZEROEDPURE_E_ZIP_PREPENDED_DATA_BUFFER_BLEEDPURE_E_ZIP_CDH_OVERFLOWPURE_E_ZIP_CDH_SIGNATUREPURE_E_ZIP_CDH_RELATIVE_OFFSET_OVERFLOWPURE_E_ZIP_CDH_RELATIVE_OFFSET_OVERLAPPURE_E_ZIP_CDH_FILE_NAME_OVERFLOWPURE_E_ZIP_CDH_EXTRA_FIELD_OVERFLOWPURE_E_ZIP_CDH_FILE_COMMENT_OVERFLOWPURE_E_ZIP_LFH_OVERFLOWPURE_E_ZIP_LFH_SIGNATUREPURE_E_ZIP_LFH_FILE_NAME_OVERFLOWPURE_E_ZIP_LFH_EXTRA_FIELD_OVERFLOWPURE_E_ZIP_LFH_UNDERFLOW_ZEROEDPURE_E_ZIP_LFH_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_LFH_DATA_OVERFLOWPURE_E_ZIP_DDR_OVERFLOWPURE_E_ZIP_LF_OVERFLOWPURE_E_ZIP_LF_UNDERFLOW_ZEROEDPURE_E_ZIP_LF_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_CD_OVERFLOWPURE_E_ZIP_CD_UNDERFLOW_ZEROEDPURE_E_ZIP_CD_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_CD_EOCDR_OVERFLOWPURE_E_ZIP_CD_EOCDR_UNDERFLOW_ZEROEDPURE_E_ZIP_CD_EOCDR_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_DIFF_LFH_GENERAL_PURPOSE_BIT_FLAGPURE_E_ZIP_DIFF_LFH_COMPRESSION_METHODPURE_E_ZIP_DIFF_LFH_LAST_MOD_FILE_TIMEPURE_E_ZIP_DIFF_LFH_LAST_MOD_FILE_DATEPURE_E_ZIP_DIFF_LFH_CRC32PURE_E_ZIP_DIFF_LFH_COMPRESSED_SIZEPURE_E_ZIP_DIFF_LFH_UNCOMPRESSED_SIZEPURE_E_ZIP_DIFF_LFH_FILE_NAME_LENGTHPURE_E_ZIP_DIFF_LFH_FILE_NAMEPURE_E_ZIP_DIFF_LFH_DDR_CRC32PURE_E_ZIP_DIFF_LFH_DDR_COMPRESSED_SIZEPURE_E_ZIP_DIFF_LFH_DDR_UNCOMPRESSED_SIZEPURE_E_ZIP_DIFF_DDR_CRC32PURE_E_ZIP_DIFF_DDR_COMPRESSED_SIZEPURE_E_ZIP_DIFF_DDR_UNCOMPRESSED_SIZEPURE_E_ZIP_FLAG_OVERFLOWPURE_E_ZIP_FLAG_TRADITIONAL_ENCRYPTIONPURE_E_ZIP_FLAG_ENHANCED_DEFLATEPURE_E_ZIP_FLAG_COMPRESSED_PATCHED_DATAPURE_E_ZIP_FLAG_STRONG_ENCRYPTIONPURE_E_ZIP_FLAG_UNUSED_BIT_7PURE_E_ZIP_FLAG_UNUSED_BIT_8PURE_E_ZIP_FLAG_UNUSED_BIT_9PURE_E_ZIP_FLAG_UNUSED_BIT_10PURE_E_ZIP_FLAG_ENHANCED_COMPRESSIONPURE_E_ZIP_FLAG_MASKED_LOCAL_HEADERSPURE_E_ZIP_FLAG_RESERVED_BIT_14PURE_E_ZIP_FLAG_RESERVED_BIT_15PURE_E_ZIP_COMPRESSION_METHOD_DANGEROUSPURE_E_ZIP_COMPRESSION_METHOD_ENCRYPTEDPURE_E_ZIP_COMPRESSION_METHOD_UNSUPPORTEDPURE_E_ZIP_STORED_COMPRESSION_SIZE_MISMATCHPURE_E_ZIP_DANGEROUS_NEGATIVE_COMPRESSION_RATIOPURE_E_ZIP_TIME_OVERFLOWPURE_E_ZIP_TIME_HOUR_OVERFLOWPURE_E_ZIP_TIME_MINUTE_OVERFLOWPURE_E_ZIP_TIME_SECOND_OVERFLOWPURE_E_ZIP_DATE_OVERFLOWPURE_E_ZIP_DATE_YEAR_OVERFLOWPURE_E_ZIP_DATE_MONTH_OVERFLOWPURE_E_ZIP_DATE_DAY_OVERFLOWPURE_E_ZIP_FILE_NAME_LENGTHPURE_E_ZIP_FILE_NAME_CONTROL_CHARACTERSPURE_E_ZIP_FILE_NAME_TRAVERSAL_DRIVE_PATHPURE_E_ZIP_FILE_NAME_TRAVERSAL_RELATIVE_PATHPURE_E_ZIP_FILE_NAME_TRAVERSAL_DOUBLE_DOTSPURE_E_ZIP_FILE_NAME_COMPONENT_OVERFLOWPURE_E_ZIP_FILE_NAME_BACKSLASHPURE_E_ZIP_EXTRA_FIELD_MAXPURE_E_ZIP_EXTRA_FIELD_MINPURE_E_ZIP_EXTRA_FIELD_ATTRIBUTE_OVERFLOWPURE_E_ZIP_EXTRA_FIELD_OVERFLOWPURE_E_ZIP_EXTRA_FIELD_UNDERFLOW_ZEROEDPURE_E_ZIP_EXTRA_FIELD_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_EXTRA_FIELD_UNICODE_PATH_OVERFLOWPURE_E_ZIP_EXTRA_FIELD_UNICODE_PATH_VERSIONPURE_E_ZIP_EXTRA_FIELD_UNICODE_PATH_DIFFPURE_E_ZIP_UNIX_MODE_OVERFLOWPURE_E_ZIP_UNIX_MODE_BLOCK_DEVICEPURE_E_ZIP_UNIX_MODE_CHARACTER_DEVICEPURE_E_ZIP_UNIX_MODE_FIFOPURE_E_ZIP_UNIX_MODE_SOCKETPURE_E_ZIP_UNIX_MODE_PERMISSIONS_STICKYPURE_E_ZIP_UNIX_MODE_PERMISSIONS_SETGIDPURE_E_ZIP_UNIX_MODE_PERMISSIONS_SETUIDPURE_E_ZIP_DIRECTORY_COMPRESSEDPURE_E_ZIP_DIRECTORY_UNCOMPRESSEDPURE_E_ZIP_SYMLINK_COMPRESSEDPURE_E_ZIP_SYMLINK_LENGTHPURE_E_ZIP_SYMLINK_CONTROL_CHARACTERSPURE_E_ZIP_SYMLINK_TRAVERSAL_DRIVE_PATHPURE_E_ZIP_SYMLINK_TRAVERSAL_RELATIVE_PATHPURE_E_ZIP_SYMLINK_TRAVERSAL_DOUBLE_DOTSPURE_E_ZIP_SYMLINK_COMPONENT_OVERFLOWPURE_E_ZIP_STRING_MAXPURE_E_ZIP_STRING_NULL_BYTEPURE_E_ZIP_INFLATEPURE_E_ZIP_INFLATE_DICTIONARYPURE_E_ZIP_INFLATE_STREAMPURE_E_ZIP_INFLATE_DATAPURE_E_ZIP_INFLATE_MEMORYPURE_E_ZIP_INFLATE_COMPRESSED_UNDERFLOWPURE_E_ZIP_INFLATE_UNCOMPRESSED_UNDERFLOWPURE_E_ZIP_AD_NIHILOPURE_E_ZIP_EX_NIHILOPURE_E_ZIP_CRC32PURE_E_ZIP_EOCDL_64_OVERFLOWPURE_E_ZIP_EOCDL_64_SIGNATUREPURE_E_ZIP_EOCDL_64_NEGATIVE_OFFSETPURE_E_ZIP_EOCDL_64_DISKPURE_E_ZIP_EOCDL_64_DISKSPURE_E_ZIP_EOCDR_64_OVERFLOWPURE_E_ZIP_EOCDR_64_SIGNATUREPURE_E_ZIP_EOCDR_EOCDL_64_OVERFLOWPURE_E_ZIP_EOCDR_EOCDL_64_UNDERFLOW_ZEROEDPURE_E_ZIP_EOCDR_EOCDL_64_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_DIFF_EOCDR_DISKPURE_E_ZIP_DIFF_EOCDR_CD_DISKPURE_E_ZIP_DIFF_EOCDR_CD_DISK_RECORDSPURE_E_ZIP_DIFF_EOCDR_CD_RECORDSPURE_E_ZIP_DIFF_EOCDR_CD_SIZEPURE_E_ZIP_DIFF_EOCDR_CD_OFFSETPURE_E_ZIP_EIEF_64_COMPRESSED_SIZEPURE_E_ZIP_EIEF_64_DISKPURE_E_ZIP_EIEF_64_RELATIVE_OFFSETPURE_E_ZIP_EIEF_64_UNCOMPRESSED_SIZEPURE_E_ZIP_EIEF_64_UNDERFLOW_ZEROEDPURE_E_ZIP_EIEF_64_UNDERFLOW_BUFFER_BLEEDPURE_E_ZIP_EIEF_64_LFHPURE_E_ZIP_DIRECTORY_HAS_NO_LFH...and this is only for zip files, we want to add static analysis for more file formats, please consider asking your company tosponsor open-source work on Pure.