@ronomon/pure
Advanced tools
Checks zip files for zip bombs, dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping he
Pure is a static analysis file format checker that checks ZIP files for dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping headers, overflow, underflow, sparseness, accidental buffer bleeds etc.
Pure's goal is to narrow the semantic gap available to attackers attempting to exploit vulnerable software, and to reduce the probability of zero-days, for example David Fifield's A better zip bomb, which was detected by an early version of Pure as a zero-day.
Pure was commissioned and sponsored by the Product Release And Security Team at Microsoft.
A special thanks to Maxim Vainstein and his team at Microsoft for their vision and encouragement.
Looking to the future, we want to add support for more archive containers (GZ, TAR, RAR etc.) and other file formats (MS-CFBF or OOXML Office files, RTF, PDF, image formats etc.). Please contact Joran Dirk Greef if you want to support new file formats in Pure.
pure.h: C interface to library source code.
pure: CLI script for development testing. Usage: ./pure <file>.
test.js: Node.js test runner to run Pure against all test files in ./tests.
binding.c: Node.js binding used by CLI and test runner.
make-errors.js: Script to recreate C error enums, error codes and error strings dynamically.
make-signatures.js: Script to recreate C signature strings dynamically.
make-tests.js: Script to recreate test files dynamically.
npm install @ronomon/pure
At the command line, you can run Pure on any zip file:
$ ./pure <file.zip>
For example:
$ ./pure samples/zbsm.zip
PURE_E_ZIP_BOMB_FIFIELD: zip bomb: local file header overlap (see research by David Fifield)
As an embedded C library, pure.h provides:
int pure_zip(
const uint8_t* buffer, // Zip file buffer
const uint64_t size, // Size of zip file buffer in bytes
const uint64_t flags // Bit flags (optional)
)
int pure_zip_bomb(const int error)
const char* pure_error_code(const int error)
const char* pure_error_string(const int error)
pure_zip() returns a non-zero error return code, or a zero return code if the zip file is clean and has no file format anomalies. A buffer instead of a path is passed to pure_zip() for portability, for reduced surface area for bugs, and to avoid forcing unnecessary IO if file contents are already in memory.
pure_zip_bomb() returns 1 if the error return code indicates a zip bomb, otherwise 0.
pure_error_code() returns the constant name of the error return code.
pure_error_string() returns the error message string corresponding the error return code.
Pure detects more than 150 zip file format anomalies.
Pure provides defenses against directory and symlink traversal exploits, dangerous unix mode permissions, parser ambiguity, and many other defenses against known (and unknown) exploits, including zip bombs and buffer overflows.
For example, Pure detects all variants of known (and unknown) zip bombs:
As a static analysis file format checker, Pure reduces the surface area for zero-day exploits by orders of magnitude. If a file can get past Pure, it's "pure"... or at least 99% pure.
Here is the exhaustive list of what Pure can already detect:
FAQs
Checks zip files for zip bombs, dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping he
We found that @ronomon/pure demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.
Security News
Research
Socket researchers found a malicious Maven package impersonating the legitimate ‘XZ for Java’ library, introducing a backdoor for remote code execution.