Repository: GoogleContainerTools/jib
File: jib-plugins-common/src/test/java/com/google/cloud/tools/jib/plugins/common/ZipUtilTest.java (Java)

Code before:
    Assume.assumeTrue(System.getProperty("os.name").startsWith("Windows"));

    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/zip-slip-win.zip").toURI());
    verifyZipSlipSafe(archive);
  }

  @Test
  public void testZipSlipVulnerability_unix() throws URISyntaxException {
    Assume.assumeFalse(System.getProperty("os.name").startsWith("Windows"));

    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/zip-slip.zip").toURI());
    verifyZipSlipSafe(archive);
  }

  @Test
  public void testUnzip_modificationTimePreserved() throws URISyntaxException, IOException {
    Path destination = tempFolder.getRoot().toPath();
    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/test.zip").toURI());
    try (ZipFile zipFile = new ZipFile(archive.toString())) {
      FileTime sourceModificationTime1 = zipFile.getEntry("file1.txt").getLastModifiedTime();
      FileTime sourceModificationTime2 = zipFile.getEntry("my-zip/file2.txt").getLastModifiedTime();
      FileTime sourceModificationTime3 =
          zipFile.getEntry("my-zip/some/sub/folder/file3.txt").getLastModifiedTime();

      ZipUtil.unzip(archive, destination);

      assertThat(Files.getLastModifiedTime(destination.resolve("file1.txt")))
          .isEqualTo(sourceModificationTime1);
      assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/file2.txt")))
          .isEqualTo(sourceModificationTime2);
      assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/some/sub/folder/file3.txt")))
          .isEqualTo(sourceModificationTime3);
    }
  }

  private void verifyUnzip(Path destination) throws URISyntaxException, IOException {
    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/test.zip").toURI());

    ZipUtil.unzip(archive, destination);

    Assert.assertTrue(Files.isDirectory(destination.resolve("my-zip/some/sub/folder")));

    Path file1 = destination.resolve("file1.txt");
    Path file2 = destination.resolve("my-zip/file2.txt");
    Path file3 = destination.resolve("my-zip/some/sub/folder/file3.txt");
    Assert.assertEquals("file1", Files.readAllLines(file1).get(0));
    Assert.assertEquals("file2", Files.readAllLines(file2).get(0));

Review comment (suggestion):
I think, in this case, we should just have these values as constants that we know. Manually look in the zip and grab the values, and use those here. That will help us determine if some other part of the machinery breaks (like getLastModifiedTime).

Code after:
  public void testZipSlipVulnerability_windows() throws URISyntaxException {
    Assume.assumeTrue(System.getProperty("os.name").startsWith("Windows"));

    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/zip-slip-win.zip").toURI());
    verifyZipSlipSafe(archive);
  }

  @Test
  public void testZipSlipVulnerability_unix() throws URISyntaxException {
    Assume.assumeFalse(System.getProperty("os.name").startsWith("Windows"));

    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/zip-slip.zip").toURI());
    verifyZipSlipSafe(archive);
  }

  @Test
  public void testUnzip_modificationTimePreserved() throws URISyntaxException, IOException {
    Path archive =
        Paths.get(Resources.getResource("plugins-common/test-archives/test.zip").toURI());
    Path destination = tempFolder.getRoot().toPath();

    ZipUtil.unzip(archive, destination);

    assertThat(Files.getLastModifiedTime(destination.resolve("file1.txt")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T14:53:05Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/file2.txt")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T14:53:44Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T15:15:48Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/some")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T14:53:38Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/some/sub")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T14:53:38Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/some/sub/folder")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T15:16:11Z")));
    assertThat(Files.getLastModifiedTime(destination.resolve("my-zip/some/sub/folder/file3.txt")))
        .isEqualTo(FileTime.from(Instant.parse("2018-08-30T15:16:12Z")));
  }

  @Test
  public void testUnzip_reproducibleTimestampsEnabled() throws URISyntaxException, IOException {
    // The zipfile has only level1/level2/level3/file.txt packaged
    Path archive =
        Paths.get(
            Resources.getResource("plugins-common/test-archives/zip-only-file-packaged.zip")
                .toURI());

    Path destination = tempFolder.getRoot().toPath();