test_class.file: lang/src/test/java/org/eclipse/steady/malice/ZipSlipAnalyzerTest.java
test_class.identifier: ZipSlipAnalyzerTest
test_case.body: @Test
    public void testZipSlipFile() {
      final MaliciousnessAnalyzer mala = new ZipSlipAnalyzer();
  
      MaliciousnessAnalysisResult is_mal;
  
      // Test the 4 archives from https://github.com/snyk/zip-slip-vulnerability
  
      is_mal = mala.isMalicious(new File("src/test/resources/zip-slip.zip"));
      assertEquals(1d, is_mal.getResult(), 0d);
  
      is_mal = mala.isMalicious(new File("src/test/resources/zip-slip-win.zip"));
      assertEquals(1d, is_mal.getResult(), 0d);
  
      is_mal = mala.isMalicious(new File("src/test/resources/zip-slip.tar"));
      assertEquals(1d, is_mal.getResult(), 0d);
  
      is_mal = mala.isMalicious(new File("src/test/resources/zip-slip-win.tar"));
      assertEquals(1d, is_mal.getResult(), 0d);
  
      // A malicious JAR
      is_mal = mala.isMalicious(new File("src/test/resources/zip-slip.jar"));
      assertEquals(1d, is_mal.getResult(), 0d);
  
      // A benign ZIP
      is_mal = mala.isMalicious(new File("src/test/resources/no-zip-slip.zip"));
      assertEquals(0d, is_mal.getResult(), 0d);
    }
test_case.class_method_signature: ZipSlipAnalyzerTest.testZipSlipFile()
test_case.full_signature: @Test public void testZipSlipFile()
test_case.identifier: testZipSlipFile
test_case.invocations: isMalicious assertEquals getResult isMalicious assertEquals getResult isMalicious assertEquals getResult isMalicious assertEquals getResult isMalicious assertEquals getResult isMalicious assertEquals getResult
test_case.modifiers: @Test public
test_case.parameters: ()
test_case.return: void
test_case.signature: void testZipSlipFile()
focal_class.declarator: log = org.apache.logging.log4j.LogManager.getLogger()
focal_class.modifier: private static final
focal_class.original_string: private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
focal_class.type: Logger
focal_class.var_name: log
focal_class.declarator: destinationPath =
        VulasConfiguration.getGlobal()
            .getTmpDir()
            .toAbsolutePath()
            .resolve(StringUtil.getRandonString(10))
focal_class.modifier: private
focal_class.original_string: private Path destinationPath =
        VulasConfiguration.getGlobal()
            .getTmpDir()
            .toAbsolutePath()
            .resolve(StringUtil.getRandonString(10));
focal_class.type: Path
focal_class.var_name: destinationPath
focal_class.file: lang/src/main/java/org/eclipse/steady/malice/ZipSlipAnalyzer.java
focal_class.identifier: ZipSlipAnalyzer
focal_class.interfaces: implements MaliciousnessAnalyzer
focal_class.class_method_signature: ZipSlipAnalyzer.isMalicious(File _file)
focal_class.full_signature: @Override public MaliciousnessAnalysisResult isMalicious(File _file)
focal_class.identifier: isMalicious
focal_class.modifiers: @Override public
focal_class.parameters: (File _file)
focal_class.return: MaliciousnessAnalysisResult
focal_class.signature: MaliciousnessAnalysisResult isMalicious(File _file)
focal_class.class_method_signature: ZipSlipAnalyzer.isMalicious(InputStream _is, boolean _log)
focal_class.full_signature: @Override public MaliciousnessAnalysisResult isMalicious(InputStream _is, boolean _log)
focal_class.identifier: isMalicious
focal_class.modifiers: @Override public
focal_class.parameters: (InputStream _is, boolean _log)
focal_class.return: MaliciousnessAnalysisResult
focal_class.signature: MaliciousnessAnalysisResult isMalicious(InputStream _is, boolean _log)
focal_method.body: @Override
    public MaliciousnessAnalysisResult isMalicious(File _file) {
      MaliciousnessAnalysisResult mal = null;
      final String name = _file.getName();
  
      try (final InputStream fis = new FileInputStream(_file)) {
        // Analyze
        if (name.endsWith(".zip")
            || name.endsWith(".jar")
            || name.endsWith(".war")
            || name.endsWith(".ear")
            || name.endsWith(".aar")) {
          mal = this.isMalicious(new ZipInputStream(fis), false);
        } else if (name.endsWith(".tar")) {
          mal = this.isMalicious(new TarArchiveInputStream(fis), false);
        } else if (name.endsWith(".tar.gz")) {
          mal =
              this.isMalicious(
                  new TarArchiveInputStream(
                      new GzipCompressorInputStream(new BufferedInputStream(fis))),
                  false);
        } else {
          log.warn("Cannot analyze [" + _file.toPath().toAbsolutePath() + "]");
        }
  
        // Log
        if (mal != null) {
          mal.setReason("[" + _file.toPath().toAbsolutePath() + "] " + mal.getReason());
          if (mal.isMalicious()) log.warn(mal.getReason());
          else log.info(mal.getReason());
        }
      } catch (FileNotFoundException fnfe) {
        log.error("File [" + _file.getAbsolutePath() + "] cannot be found");
      } catch (IOException ioe) {
        log.error(
            ioe.getClass().getSimpleName()
                + " when opening ["
                + _file.getAbsolutePath()
                + "]: "
                + ioe.getMessage(),
            ioe);
      }
      return mal;
    }
focal_method.class_method_signature: ZipSlipAnalyzer.isMalicious(File _file)
focal_method.full_signature: @Override public MaliciousnessAnalysisResult isMalicious(File _file)
focal_method.identifier: isMalicious
focal_method.invocations: getName endsWith endsWith endsWith endsWith endsWith isMalicious endsWith isMalicious endsWith isMalicious warn toAbsolutePath toPath setReason toAbsolutePath toPath getReason isMalicious warn getReason info getReason error getAbsolutePath error getSimpleName getClass getAbsolutePath getMessage
focal_method.modifiers: @Override public
focal_method.parameters: (File _file)
focal_method.return: MaliciousnessAnalysisResult
focal_method.signature: MaliciousnessAnalysisResult isMalicious(File _file)