DevComp/zip-rs-wasm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #289 from zip-rs/issue/281

Browse source 
docs: add a note about password handling
This commit is contained in:
Alexander Zaitsev 2022-03-26 00:44:45 +03:00 • committed by GitHub
commit 574bb3df17
Signed by: DevComp
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/read.rs
View file

@ -506,6 +506,12 @@ impl<R: Read + io::Seek> ZipArchive<R> {
/// The implementation of the cryptographic algorithms has not /// The implementation of the cryptographic algorithms has not
/// gone through a correctness review, and you should assume it is insecure: /// gone through a correctness review, and you should assume it is insecure:
/// passwords used with this API may be compromised. /// passwords used with this API may be compromised.
///
/// This function sometimes accepts wrong password. This is because the ZIP spec only allows us
/// to check for a 1/256 chance that the password is correct.
/// There are many passwords out there that will also pass the validity checks
/// we are able to perform. This is a weakness of the ZipCrypto algorithm,
/// due to its fairly primitive approach to cryptography.
pub fn by_name_decrypt<'a>( pub fn by_name_decrypt<'a>(
&'a mut self, &'a mut self,
name: &str, name: &str,
@ -540,6 +546,12 @@ impl<R: Read + io::Seek> ZipArchive<R> {
/// The implementation of the cryptographic algorithms has not /// The implementation of the cryptographic algorithms has not
/// gone through a correctness review, and you should assume it is insecure: /// gone through a correctness review, and you should assume it is insecure:
/// passwords used with this API may be compromised. /// passwords used with this API may be compromised.
///
/// This function sometimes accepts wrong password. This is because the ZIP spec only allows us
/// to check for a 1/256 chance that the password is correct.
/// There are many passwords out there that will also pass the validity checks
/// we are able to perform. This is a weakness of the ZipCrypto algorithm,
/// due to its fairly primitive approach to cryptography.
pub fn by_index_decrypt<'a>( pub fn by_index_decrypt<'a>(
&'a mut self, &'a mut self,
file_number: usize, file_number: usize,