unable to unzip jar files

[xt0x1c]

While scanning nested .jar files, the scanner exiting with an error:

./local-log4j-vuln-scanner  --exclude /proc  /
local-log4j-vuln-scanner - a simple local log4j vulnerability scanner

OUTPUT
cant't open JAR file: /../../../FOO-1.0.0-BAR.jar (size 19165951): zip: not a valid zip file
….

manual unzipping the file work's fine

unzip -l /../../../FOO-1.0.0-BAR.jar
Archive:  /../../../FOO-1.0.0-BAR.jar
warning [ /../../../FOO-1.0.0-BAR.jar ]:  8500 extra bytes at beginning or within zipfile
  (attempting to process anyway)

[hillu]

Looks like the Go archive/zip implementation is more strict than unzip. Can you provide the file?

[xt0x1c]

i tried to reproduce the problem with other files and figured out, that all files are executable jar's

see for reference
https://docs.spring.io/spring-boot/docs/current/reference/html/executable-jar.html

to reproduce the problem you can take thr jar files from this project like the attached

database-1.0.0-SNAPSHOT.jar.zip

[collegian]

@t0xic-coder How did you resolve the problem? I'm seeing the same thing.

[Champ586]

@collegian Just unzip your jar to some directory and pass that directory to scanner.
unzip your-jar.jar -d some-dir

[FilipDeVos]

I looked a bit more into this and there might be a way to add this.

• Add support for processing files with prepended bytes before the zip archive anchore/syft#428 --> contains implementation of OpenZip
  --> this project is apache 2 licensed, but https://www.apache.org/licenses/GPL-compatibility.html states that it is ok to include
• archive/zip: Zip reading with prefixed bytes golang/go#10464 --> contains a patch for archive/zip

[hillu]

For whatever reason I only now realized that I had code written for the simple "ZIP appended to something else" laying around in various incarnations.

@t0xic-coder, @FilipDeVos (or anyone else), could you please give the code in https://github.com/hillu/local-log4j-vuln-scanner/tree/feature/broken-zip a try and tell me that it works for your use-cases? Thanks.

[FilipDeVos]

@hillu I will take a look and try it out later today.

[hillu]

@FilipDeVos I have pushed the change to the master branch and tagged that in the meantime. Thanks in advance for looking into it, anyway.

[FilipDeVos]

I tested and it works properly. Thank you so much.

[hillu]

@FilipDeVos Thank you. I guess the issue can be closed then.