search

ZJONSSON / node-unzipper

node.js cross-platform unzip using streams
Other
441 stars 116 forks source link

Max password length? #55

Closed amitdhawan closed 6 years ago

amitdhawan commented 6 years ago

Hi,

what is the max password length of zip file that is supported by unzipper ?

Currently i have a lengthy password and unzipper says BAD_PASSWORD.

ZJONSSON commented 6 years ago

The decryption code matches the algorithm described in 6.3.4 .ZIP File Format Specification with the implementation here and python implementation here

To my understanding there is not a password length limit, however there are alternate encryption methods available in modern zip that are not covered by the unzipper module. Can you replicate the error with a shorter password?

image

amitdhawan commented 6 years ago

Im not sure about the password encryption technique used as I get the zip file from one of my clients. Any way I can check out the encryption method used to encrypt the zip?

From: Ziggy Jonsson Reply-To: ZJONSSON/node-unzipper Date: Wednesday, 28 February 2018 at 6:16 PM To: ZJONSSON/node-unzipper Cc: Amit Dhawan, Author Subject: Re: [ZJONSSON/node-unzipper] Max password length? (#55)

The decryption code matches the algorithm described in 6.3.4 .ZIP File Format Specificationhttps://urldefense.proofpoint.com/v2/url?u=https-3A__pkware.cachefly.net_webdocs_casestudies_APPNOTE.TXT&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=rn2DifrtjcYf7TgUqJHq4Y0F88uQD7uvUwJbPA9Kd60&e= with the implementation herehttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ZJONSSON_node-2Dunzipper_pull_26&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=W9h5FgF09meRzoNVGEkkK6pa7XV31jvoQPi18Tmi6eQ&e= and python implementation herehttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_python_cpython_blob_master_Lib_zipfile.py-23L509-2DL567&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=lvf0BxkpsgHdoA8i-ixcSwxrfANRqGwC-2T-PpD_Sm8&e=

To my understanding there is not a password length limit, however there are alternate encryption methods available in modern zip that are not covered by the unzipper module. Can you replicate the error with a shorter password?

[image]https://urldefense.proofpoint.com/v2/url?u=https-3A__user-2Dimages.githubusercontent.com_1082488_36788290-2D5dd0328e-2D1c5b-2D11e8-2D9420-2D8bfdee4c172f.png&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=Dd6Q4khNqpuvB4_UQF9qV-I_09go8I-qMiTjUtnWTO8&e=

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ZJONSSON_node-2Dunzipper_issues_55-23issuecomment-2D369228749&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=JPODBAPfstG9xQJe9QnywCm5Ii9nbUbJ4Ev6UVQXReg&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AOMhBnmbqK7aaKk79RK9o36R44NUWNDeks5tZUqdgaJpZM4SWUiD&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=IYP1DntLKkzvnKg4LWusdSl7wH9JPw74WIsxoqR5cwQ&m=gpbC2FeItaj94bcY4vFtdxWnI7LbovPOtbouHYvcJu8&s=9F9U5PdTj8TNOvp6zS3F7xYLV3If7hgZ9QdIYalfIAg&e=.

ZJONSSON commented 6 years ago

I would need further information to debug this. Please feel free to reopen if you have more detail (plus a file that is not working)