DevComp/zip-rs-wasm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

docs: add a note about password handling

Browse source
This commit is contained in:
Alexander Zaitsev 2022-03-25 17:13:19 +03:00
parent 2be9ae871f
commit b0306318f1
No known key found for this signature in database
GPG key ID: FC891851263F1E5D
1 changed files with 16 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/read.rs
View file

@ -500,12 +500,18 @@ impl<R: Read + io::Seek> ZipArchive<R> {
} }
/// Search for a file entry by name, decrypt with given password /// Search for a file entry by name, decrypt with given password
/// ///
/// # Warning /// # Warning
/// ///
/// The implementation of the cryptographic algorithms has not /// The implementation of the cryptographic algorithms has not
/// gone through a correctness review, and you should assume it is insecure: /// gone through a correctness review, and you should assume it is insecure:
/// passwords used with this API may be compromised. /// passwords used with this API may be compromised.
///
/// This function sometimes accepts wrong password. This is because the ZIP spec only allows us
/// to check for a 1/256 chance that the password is correct.
/// There are many passwords out there that will also pass the validity checks
/// we are able to perform. This is a weakness of the ZipCrypto algorithm,
/// due to its fairly primitive approach to cryptography.
pub fn by_name_decrypt<'a>( pub fn by_name_decrypt<'a>(
&'a mut self, &'a mut self,
name: &str, name: &str,
@ -534,12 +540,18 @@ impl<R: Read + io::Seek> ZipArchive<R> {
} }
/// Get a contained file by index, decrypt with given password /// Get a contained file by index, decrypt with given password
/// ///
/// # Warning /// # Warning
/// ///
/// The implementation of the cryptographic algorithms has not /// The implementation of the cryptographic algorithms has not
/// gone through a correctness review, and you should assume it is insecure: /// gone through a correctness review, and you should assume it is insecure:
/// passwords used with this API may be compromised. /// passwords used with this API may be compromised.
///
/// This function sometimes accepts wrong password. This is because the ZIP spec only allows us
/// to check for a 1/256 chance that the password is correct.
/// There are many passwords out there that will also pass the validity checks
/// we are able to perform. This is a weakness of the ZipCrypto algorithm,
/// due to its fairly primitive approach to cryptography.
pub fn by_index_decrypt<'a>( pub fn by_index_decrypt<'a>(
&'a mut self, &'a mut self,
file_number: usize, file_number: usize,