core/system/Execute.go

/*
File Username:  Execute.go
Copyright:  2021 Peernet s.r.o.
Author:     Peter Kleissner
*/

package system

import (
	"archive/zip"
	"errors"
	"io"
	"os"
	"path/filepath"
	"strings"
)

// Execute the actions described in the info header
func (update *UpdatePackage) Execute(DataFolder, PluginFolder string) (err error) {
	for _, action := range update.Header.Actions {
		switch action.Action {
		case "extract":
			destination := resolveFolders(action.Target, DataFolder, PluginFolder)

			for _, f := range update.Reader.File {
				// filter the filename based on source
				if !strings.HasPrefix(f.Name, action.Source) {
					continue
				}

				err := unzipFile(f, destination)
				if err != nil {
					return err
				}
			}
		}
	}

	return nil
}

// Deletes the update package file
func (update *UpdatePackage) Delete() (err error) {
	return os.Remove(update.Filename)
}

func unzipFile(f *zip.File, destination string) error {
	// 4. Check if file paths are not vulnerable to Zip Slip
	filePath := filepath.Join(destination, f.Name)
	if !strings.HasPrefix(filePath, filepath.Clean(destination)+string(os.PathSeparator)) {
		return errors.New("invalid file path: " + filePath)
	}

	// 5. Create directory tree
	if f.FileInfo().IsDir() {
		if err := os.MkdirAll(filePath, os.ModePerm); err != nil {
			return err
		}
		return nil
	}

	if err := os.MkdirAll(filepath.Dir(filePath), os.ModePerm); err != nil {
		return err
	}

	// 6. Create a destination file for unzipped content
	destinationFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
	if err != nil {
		return err
	}
	defer destinationFile.Close()

	// 7. Unzip the content of a file and copy it to the destination file
	zippedFile, err := f.Open()
	if err != nil {
		return err
	}
	defer zippedFile.Close()

	if _, err := io.Copy(destinationFile, zippedFile); err != nil {
		return err
	}
	return nil
}

func resolveFolders(folder, dataFolder, pluginFolder string) (resolved string) {
	resolved = strings.Replace(folder, "%plugin%", pluginFolder, 1)
	resolved = strings.Replace(resolved, "%data%", dataFolder, 1)

	return resolved
}