Windows中压缩包可能出现的安全问题及相关缓解方案参考

using System;using System.Collections.Generic;using System.IO;using System.IO.Compression;using System.Runtime.InteropServices; class Program{    static void Main(string[] args)    {        if (args.Length == 0)        {            Console.WriteLine("请提供至少一个要检查的ZIP文件的路径或包含ZIP文件的目录路径");            return;        }         List<string> zipFiles = new List<string>();        List<string> results = new List<string>();         foreach (string path in args)        {            if (Directory.Exists(path))            {                foreach (string file in Directory.GetFiles(path, "*.zip", SearchOption.AllDirectories))                {                    zipFiles.Add(file);                }            }            else if (File.Exists(path) && path.ToLower().EndsWith(".zip"))            {                zipFiles.Add(path);            }            else            {                Console.WriteLine($"路径 {path} 不是一个有效的ZIP文件或目录");            }        } // 打印所有扫描到的ZIP文件路径        foreach (string zipFile in zipFiles)        {            Console.WriteLine($"正在扫描ZIP文件: {zipFile}");        }         // 检查ZIP文件中的文件名安全性        foreach (string zipFile in zipFiles)        {            results.AddRange(CheckZipFiles(zipFile));        }         // 打印所有检测结果        foreach (string result in results)        {            Console.WriteLine(result);        }    }     static List<string> CheckZipFiles(string zipFilePath)    {        List<string> results = new List<string>();        try        {            using (ZipArchive zip = ZipFile.OpenRead(zipFilePath))            {                foreach (ZipArchiveEntry entry in zip.Entries)                {                    if (!IsSafePath(entry.FullName))                    {                        results.Add($"不安全的文件名: {entry.FullName} 在ZIP文件 {zipFilePath} 中被检测到");                    }                }            }        }        catch (InvalidDataException)        {            results.Add($"无法打开ZIP文件: {zipFilePath}");        }        return results;    } static bool IsSafePath(string entryName)    {        // 获取当前工作目录        string currentDirectory = Directory.GetCurrentDirectory();         // 获取绝对路径        string fullPath = Path.GetFullPath(Path.Combine(currentDirectory, entryName));         // 检查绝对路径是否在当前工作目录之下        return fullPath.StartsWith(currentDirectory, StringComparison.OrdinalIgnoreCase);    }}

42.zip  |  ├── file1.zip (包含多个重复数据文件)  ├── file2.zip (包含多个重复数据文件)  └── ... (多个嵌套的ZIP文件)

using System;using System.IO;using System.IO.Compression;using System.Diagnostics; class Program{    // 配置最大解压后的文件大小和文件数量限制    private const long MAX_UNCOMPRESSED_SIZE = 100 * 1024 * 1024; // 设置为100 MB    private const int MAX_FILE_COUNT = 100; //设置为100个文件     static void Main(string[] args)    {        // 指定要解压的ZIP文件路径        string zipFilePath = "C:\Users\Administrator\Desktop\zip-test\test.zip";        string zipFileDir = Path.GetDirectoryName(zipFilePath);         try        {            // 初步检查：检查zip文件本身的大小是否超过限制            FileInfo fileInfo = new FileInfo(zipFilePath);            Console.WriteLine("Size of zip: " + fileInfo.Length);            if (fileInfo.Length > MAX_UNCOMPRESSED_SIZE)            {                throw new Exception("File size exceeds limit");            }            Console.WriteLine("Size of zip safe!");             // 解压前检查：估算解压后的总大小和文件数量            (long totalUncompressedSize, int fileCount) = EstimateUncompressedSize(zipFilePath);            Console.WriteLine("Estimate files size: " + totalUncompressedSize);            Console.WriteLine("Estimate files count: " + fileCount);            if (totalUncompressedSize > MAX_UNCOMPRESSED_SIZE)            {                throw new Exception("Estimated uncompressed size exceeds limit");            }            if (fileCount > MAX_FILE_COUNT)            {                throw new Exception("File count exceeds limit");            }            Console.WriteLine("Size of files safe!");            Console.WriteLine("Count of files safe!");             ExtractZipSafely(zipFilePath, zipFileDir);             // 监控资源：监控解压过程中的资源消耗            MonitorResources();             Console.WriteLine("ZIP file extracted successfully!");        }        catch (Exception e)        {            Console.WriteLine($"Error: {e.Message}");        }    }     // 估算解压后的总大小和文件数量    private static (long, int) EstimateUncompressedSize(string zipFilePath)    {        long totalUncompressedSize = 0;        int fileCount = 0;        using (ZipArchive archive = ZipFile.OpenRead(zipFilePath))        {            foreach (ZipArchiveEntry entry in archive.Entries)            {                totalUncompressedSize += entry.Length;                fileCount++;            }        }        return (totalUncompressedSize, fileCount);    }     // 检查文件类型是否安全    private static bool IsSafeFileType(string fileName)    {        // 仅允许特定类型的文件（如果需要）        string[] allowedExtensions = { ".txt", ".jpg", ".png", ".pdf" };        string ext = Path.GetExtension(fileName).ToLower();        return Array.Exists(allowedExtensions, e => e == ext);    }    // 检查文件路径是否安全    private static bool IsSafePath(string filePath, string baseDir)    {        // 确保路径在指定的基目录下        return Path.GetFullPath(filePath).StartsWith(baseDir, StringComparison.OrdinalIgnoreCase);    }     // 安全地解压ZIP文件    private static void ExtractZipSafely(string zipFilePath, string extractTo)    {        using (ZipArchive archive = ZipFile.OpenRead(zipFilePath))        {            foreach (ZipArchiveEntry entry in archive.Entries)            {                string fileName = entry.FullName;                if (!IsSafeFileType(fileName))                {                    throw new Exception($"Unsafe file type detected: {fileName}");                }                Console.WriteLine("File type safe!");                 string extractPath = Path.Combine(extractTo, fileName);                if (!IsSafePath(extractPath, extractTo))                {                    throw new Exception($"Unsafe file path detected: {extractPath}");                }                Console.WriteLine("File path safe!");                 // 创建目录（如果需要）                string directoryPath = Path.GetDirectoryName(extractPath);                if (!Directory.Exists(directoryPath))                {                    Directory.CreateDirectory(directoryPath);                }                 // 解压文件                entry.ExtractToFile(extractPath);            }        }    }    // 监控资源使用情况    private static void MonitorResources()    {        Process currentProcess = Process.GetCurrentProcess();        if (currentProcess.WorkingSet64 > MAX_UNCOMPRESSED_SIZE)        {            throw new Exception("Memory usage exceeds limit");        }        Console.WriteLine("Memory usage safe!");        if (currentProcess.TotalProcessorTime.TotalMilliseconds > 2000)  //此处设定为2000毫秒，可根据需要设定        {            throw new Exception("CPU usage exceeds limit");        }        Console.WriteLine("CPU usage safe!");    }}