unable to unzip jar files about local-log4j-vuln-scanner

[Champ586]

@collegian Just unzip your jar to some directory and pass that directory to scanner.
unzip your-jar.jar -d some-dir

[hillu]

@FilipDeVos Thank you. I guess the issue can be closed then.

[hillu]

Looks like the Go archive/zip implementation is more strict than unzip. Can you provide the file?

[xt0x1c]

i tried to reproduce the problem with other files and figured out, that all files are executable jar's

see for reference
https://docs.spring.io/spring-boot/docs/current/reference/html/executable-jar.html

to reproduce the problem you can take thr jar files from this project like the attached

database-1.0.0-SNAPSHOT.jar.zip

[collegian]

@t0xic-coder How did you resolve the problem? I'm seeing the same thing.

[FilipDeVos]

I looked a bit more into this and there might be a way to add this.

• anchore/syft#428 --> contains implementation of OpenZip
  --> this project is apache 2 licensed, but https://www.apache.org/licenses/GPL-compatibility.html states that it is ok to include
• golang/go#10464 --> contains a patch for archive/zip

[hillu]

For whatever reason I only now realized that I had code written for the simple "ZIP appended to something else" laying around in various incarnations.

@t0xic-coder, @FilipDeVos (or anyone else), could you please give the code in https://github.com/hillu/local-log4j-vuln-scanner/tree/feature/broken-zip a try and tell me that it works for your use-cases? Thanks.

[FilipDeVos]

@hillu I will take a look and try it out later today.

[hillu]

@FilipDeVos I have pushed the change to the master branch and tagged that in the meantime. Thanks in advance for looking into it, anyway.

[FilipDeVos]

I tested and it works properly. Thank you so much.