[pmg-devel] [PATCH pmg-api] fix #4536: parse original filenames from gzip files

[Leo Nunner]

On 2023-03-03 12:43, Stoiko Ivanov wrote:
> Thank you very much for addressing the issue and providing the patch!
> technically I think this seems like a good approach!
>
> one thing I'm not 100% sure about is, why the finding of the filename from
> header is done in uncompress_file and not in __unpack_archive (where the
> $newname variable is originally assigned)?
> https://git.proxmox.com/?p=pmg-api.git;a=blob;f=src/PMG/Unpack.pm;h=d4fe4547ba9341a23a6841f9e24b756ed65605df;hb=HEAD#l1014

Something that Dominik pointed out to me offlist: we might want to push
both the original name *and* the generated name (using
add_glob_mime_type), since we only need to store the original name to
iterate over and not actually save anything there (as otherwise, someone
could just write *any* path in the header and we'll save the attachment
there…).

If we do that (i.e., just add another add_glob_mime_type call in the if
block), I feel like it might still be a better choice in
uncompress_file, but that's more personal preference.

> IIUC $newname is also an absolute path to a tempdir (which conveniently
> also gets cleaned up on exit)
>
> did not run any explicit tests yet - but thought I'll ask anyways.

FWIW, the regression tests all passed for me. I'll send a v2 either way,
because we should also update the debian control file to explicitly
include libio-compress-perl for IO::Uncompress::Gunzip.

> On Fri,  3 Mar 2023 11:04:56 +0100
> Leo Nunner <l.nunner at proxmox.com> wrote:
>
>> GZIP provides the possiblity to store the original filename in the
>> optional FNAME header field, which we can use for 'Match Archive
>> Filename' rules.
>>
>> IO::Uncompress::Gunzip is explicitly recommended for this purpose by the
>> documentation on Compress::Zlib, so an additional imnport was
>> introduced here.
>>
>> Signed-off-by: Leo Nunner <l.nunner at proxmox.com>
>> ---
>>  src/PMG/Unpack.pm | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/src/PMG/Unpack.pm b/src/PMG/Unpack.pm
>> index d4fe454..f79ed3f 100755
>> --- a/src/PMG/Unpack.pm
>> +++ b/src/PMG/Unpack.pm
>> @@ -7,6 +7,7 @@ use IO::Select;
>>  use Xdgmime;
>>  use Compress::Zlib qw(gzopen);
>>  use Compress::Bzip2 qw(bzopen);
>> +use IO::Uncompress::Gunzip;
>>  use File::Path;
>>  use File::Temp qw(tempdir);
>>  use File::Basename;
>> @@ -298,6 +299,13 @@ sub uncompress_file {
>>  	$maxsize = min2 ($maxsize, $filesize * $self->{maxratio});
>>      }
>>  
>> +    if($app eq 'guzip' && (my $z = IO::Uncompress::Gunzip->new($filename))) {
>> +	# the name (FNAME) field is optional in GZIP archives, so we won't
>> +	# always have a value here
>> +	my $header = $z->getHeaderInfo();
>> +	$newname = $header->{Name} if $header->{Name};
>> +    }
>> +
>>      $self->add_glob_mime_type ($newname);
>>  
>>      my $outfd;