Fixed issues #672 and #674 (#675)

* Fixed #674

* Fixed path traversal vulnerability noted by https://app.snyk.io/org/bowring/project/7dd848fc-362b-4514-a91c-3c04628633ac

* Fixed path traversal vulnerability noted by https://app.snyk.io/org/bowring/project/7dd848fc-362b-4514-a91c-3c04628633ac

* Fixed typos

* Updated test files due to issue #672

* updated dependencies

Author: bowring

squidApp/src/main/java/org/cirdles/squid/gui/ProjectManagerController.java

@@ -253,6 +253,7 @@ public void changed(ObservableValue<? extends String> observable, String oldValu
             squidProject.setExtPErrU(newValue);
             SquidProject.setProjectChanged(true);
             task.setExtPErrU(newValue);
+            task.setChanged(true);
         });
 
         SpinnerValueFactory<Double> valueFactoryTh
@@ -263,6 +264,7 @@ public void changed(ObservableValue<? extends String> observable, String oldValu
             squidProject.setExtPErrTh(newValue);
             SquidProject.setProjectChanged(true);
             task.setExtPErrTh(newValue);
+            task.setChanged(true);
         });
     }
 

squidApp/src/main/java/org/cirdles/squid/gui/SquidUIController.java

@@ -1825,6 +1825,10 @@ private void synchronizeTaskLabDataAndSquidVersion() throws SquidException {
 
 
             if (SquidProject.isProjectChanged()) {
+                // dec 2021 for issue #674
+                task.setExtPErrU(squidProject.getExtPErrU());
+                task.setExtPErrTh(squidProject.getExtPErrTh());
+
                 // next two lines make sure 15-digit rounding is used by reprocessing data
                 task.setChanged(true);
                 task.setupSquidSessionSpecsAndReduceAndReport(true);

squidCore/build.gradle

@@ -34,7 +34,8 @@ dependencies {
     // https://mvnrepository.com/artifact/org.apache.poi/poi
     implementation group: 'org.apache.poi', name: 'poi', version: '5.0.0'
 
-    implementation group: 'org.jdom', name: 'jdom2', version: '2.0.6'
+    // https://mvnrepository.com/artifact/org.jdom/jdom2
+    implementation group: 'org.jdom', name: 'jdom2', version: '2.0.6.1'
 
     implementation 'com.github.opencollab.jlatexmath:jlatexmath:1.0.7'
     implementation group: 'com.openhtmltopdf', name: 'openhtmltopdf-pdfbox', version: '1.0.10'

squidCore/src/main/java/org/cirdles/squid/core/PrawnXMLFileHandler.java

@@ -358,4 +358,4 @@ public CalamariReportsEngine getNewReportsEngine() {
         initReportsEngineWithCurrentPrawnFileName();
         return reportsEngine;
     }
-}
+}

squidCore/src/main/java/org/cirdles/squid/tasks/Task.java

@@ -574,7 +574,6 @@ public void updateTaskDesignFromTask(TaskDesign taskDesign, boolean includeCusto
 
     public boolean taskDesignDiffersFromTask(TaskDesign taskDesign) {
         boolean noChange = false;
-//        if (taskType.equals(TaskTypeEnum.GEOCHRON)) {
         List<String> taskMasses = getNominalMasses();
         List<String> designerMasses = taskDesign.getNominalMasses();
         designerMasses.addAll(REQUIRED_NOMINAL_MASSES);
@@ -584,27 +583,10 @@ public boolean taskDesignDiffersFromTask(TaskDesign taskDesign) {
         List<String> designerRatios = taskDesign.getRatioNames();
         designerRatios.addAll(REQUIRED_RATIO_NAMES);
         noChange = noChange && taskRatios.containsAll(designerRatios) && designerRatios.containsAll(taskRatios);
-
-//            // test background index and 4 horsemen and directives
-//            noChange = noChange && (isDirectAltPD() == taskDesign.isDirectAltPD());
-//            noChange = noChange && (isPbU() == taskDesign.isPbU());
-//            noChange = noChange
-//                    && (getSpecialSquidFourExpressionsMap().get(UNCOR206PB238U_CALIB_CONST).compareToIgnoreCase(
-//                            taskDesign.getSpecialSquidFourExpressionsMap().get(UNCOR206PB238U_CALIB_CONST)) == 0);
-//            noChange = noChange
-//                    && (getSpecialSquidFourExpressionsMap().get(UNCOR208PB232TH_CALIB_CONST).compareToIgnoreCase(
-//                            taskDesign.getSpecialSquidFourExpressionsMap().get(UNCOR208PB232TH_CALIB_CONST)) == 0);
-//            noChange = noChange
-//                    && (getSpecialSquidFourExpressionsMap().get(TH_U_EXP_DEFAULT).compareToIgnoreCase(
-//                            taskDesign.getSpecialSquidFourExpressionsMap().get(TH_U_EXP_DEFAULT)) == 0);
-//            noChange = noChange
-//                    && (getSpecialSquidFourExpressionsMap().get(PARENT_ELEMENT_CONC_CONST).compareToIgnoreCase(
-//                            taskDesign.getSpecialSquidFourExpressionsMap().get(PARENT_ELEMENT_CONC_CONST)) == 0);
-//
         noChange = noChange && (getIndexOfBackgroundSpecies() == taskDesign.getIndexOfBackgroundSpecies());
 
         System.out.println("nochange = " + noChange);
-//        }
+
         return noChange;
     }
 
@@ -642,8 +624,15 @@ private void generateConstants() {
     }
 
     private void generateParameters() {
-        Map<String, ExpressionTreeInterface> parameters = BuiltInExpressionsFactory.generateParameters();
         this.namedParametersMap = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+
+        // dec 2021 issue #674 - parameters were set to defaults in builder and need to be set here instead
+        Map<String, ExpressionTreeInterface> parameters = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        ExpressionTreeInterface extPErrUExp = new ConstantNode(MIN_206PB238U_EXT_1SIGMA_ERR_PCT, extPErrU);
+        parameters.put(MIN_206PB238U_EXT_1SIGMA_ERR_PCT, extPErrUExp);
+        ExpressionTreeInterface extPErrThExp = new ConstantNode(MIN_208PB232TH_EXT_1SIGMA_ERR_PCT, extPErrTh);
+        parameters.put(MIN_208PB232TH_EXT_1SIGMA_ERR_PCT, extPErrThExp);
+
         namedParametersMap.putAll(parameters);
     }
 

squidCore/src/main/java/org/cirdles/squid/tasks/expressions/builtinExpressions/BuiltInExpressionsFactory.java

@@ -64,22 +64,6 @@ public static Map<String, ExpressionTreeInterface> generateConstants() {
         return constants;
     }
 
-    /**
-     * @return
-     */
-    public static Map<String, ExpressionTreeInterface> generateParameters() {
-        Map<String, ExpressionTreeInterface> parameters = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
-
-        // over written by task
-        ExpressionTreeInterface extPErrU = new ConstantNode(MIN_206PB238U_EXT_1SIGMA_ERR_PCT, 0.75);
-        parameters.put(MIN_206PB238U_EXT_1SIGMA_ERR_PCT, extPErrU);
-
-        ExpressionTreeInterface extPErrTh = new ConstantNode(MIN_208PB232TH_EXT_1SIGMA_ERR_PCT, 0.75);
-        parameters.put(MIN_208PB232TH_EXT_1SIGMA_ERR_PCT, extPErrTh);
-
-        return parameters;
-    }
-
     /**
      * @return Map<String, ExpressionTreeInterface> spotLookupFields
      */
@@ -684,7 +668,7 @@ public static SortedSet<Expression> generateOverCountExpressions(boolean isDirec
         overCountExpressionsOrdered.add(expressionOverCountPerSec4_7);
 
         Expression expressionOverCount7CorrCalib = buildExpression(CORR_7_PRIMARY_CALIB_CONST_DELTA_PCT,
-                "ABS(100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + OVER_COUNT_4_6_7 + "\"])-1))", true, false, false);
+                "100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + OVER_COUNT_4_6_7 + "\"])-1)", true, false, false);
         overCountExpressionsOrdered.add(expressionOverCount7CorrCalib);
 
         // new section to accommodate reporting corrections per Bodorkos 13 Aug 2018
@@ -700,7 +684,7 @@ public static SortedSet<Expression> generateOverCountExpressions(boolean isDirec
             overCountExpressionsOrdered.add(expressionOverCountPerSec4_8);
 
             Expression expressionOverCount8CorrCalib = buildExpression(CORR_8_PRIMARY_CALIB_CONST_DELTA_PCT,
-                    "ABS(100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + OVER_COUNT_4_6_8 + "\"])-1)) ", true, false, false);
+                    "100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + OVER_COUNT_4_6_8 + "\"])-1) ", true, false, false);
             overCountExpressionsOrdered.add(expressionOverCount8CorrCalib);
 
         } else {
@@ -716,7 +700,7 @@ public static SortedSet<Expression> generateOverCountExpressions(boolean isDirec
             overCountExpressionsOrdered.add(expression4CorrOverCountPerSec4_8);
 
             Expression expression4CorrOverCount8CorrCalib = buildExpression("" + PB4CORR + CORR_8_PRIMARY_CALIB_CONST_DELTA_PCT,
-                    "ABS(100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + PB4CORR + OVER_COUNT_4_6_8 + "\"])-1)) ", true, false, false);
+                    "100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + PB4CORR + OVER_COUNT_4_6_8 + "\"])-1) ", true, false, false);
             overCountExpressionsOrdered.add(expression4CorrOverCount8CorrCalib);
 
             Expression expression7CorrOverCount4_6_8 = buildExpression(PB7CORR + OVER_COUNT_4_6_8,
@@ -730,7 +714,7 @@ public static SortedSet<Expression> generateOverCountExpressions(boolean isDirec
             overCountExpressionsOrdered.add(expression7CorrOverCountPerSec4_8);
 
             Expression expression7CorrOverCount8CorrCalib = buildExpression(PB7CORR + CORR_8_PRIMARY_CALIB_CONST_DELTA_PCT,
-                    "ABS(100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + PB7CORR + OVER_COUNT_4_6_8 + "\"])-1)) ", true, false, false);
+                    "100*((1-" + COM_64 + "*[" + R204206 + "])/(1-" + COM_64 + "*[\"" + PB7CORR + OVER_COUNT_4_6_8 + "\"])-1) ", true, false, false);
             overCountExpressionsOrdered.add(expression7CorrOverCount8CorrCalib);
         }
 
@@ -787,44 +771,44 @@ public static SortedSet<Expression> generatePerSpotProportionsOfCommonPb() {
         // for ref materials
         // sept 2019 - remove double duty RU expressions - 3 cases below
         Expression expression4corCom206RM = buildExpression(PB4CORR + COM206PB_PCT_RM,
-                "ABS(100*" + COM_64 + "*[" + R204206 + "])", true, false, false);
+                "100*" + COM_64 + "*[" + R204206 + "]", true, false, false);
         perSpotPbCorrectionsOrdered.add(expression4corCom206RM);
 
         Expression expression7corCom206RM = buildExpression(PB7CORR + COM206PB_PCT_RM,
-                "ABS(100*" + COM_64 + "*[\"" + OVER_COUNT_4_6_7 + "\"])", true, false, false);
+                "100*" + COM_64 + "*[\"" + OVER_COUNT_4_6_7 + "\"]", true, false, false);
         perSpotPbCorrectionsOrdered.add(expression7corCom206RM);
 
         Expression expression8corCom206RM = buildExpression(PB8CORR + COM206PB_PCT_RM,
-                "ABS(100*" + COM_64 + "*[\"" + OVER_COUNT_4_6_8 + "\"])", true, false, false);
+                "100*" + COM_64 + "*[\"" + OVER_COUNT_4_6_8 + "\"]", true, false, false);
         perSpotPbCorrectionsOrdered.add(expression8corCom206RM);
 
         Expression expression4corCom208RM = buildExpression(PB4CORR + COM208PB_PCT_RM,
-                "ABS(100*" + COM_84 + "/[" + R208206 + "]*[" + R204206 + "])", true, false, false);
+                "100*" + COM_84 + "/[" + R208206 + "]*[" + R204206 + "]", true, false, false);
         perSpotPbCorrectionsOrdered.add(expression4corCom208RM);
 
         Expression expression7corCom208RM = buildExpression(PB7CORR + COM208PB_PCT_RM,
-                "ABS(100*" + COM_84 + "/[" + R208206 + "]*[\"" + OVER_COUNT_4_6_7 + "\"])", true, false, false);
+                "100*" + COM_84 + "/[" + R208206 + "]*[\"" + OVER_COUNT_4_6_7 + "\"]", true, false, false);
         perSpotPbCorrectionsOrdered.add(expression7corCom208RM);
 
         // for samples
         Expression expression4corCom206 = buildExpression(PB4CORR + COM206PB_PCT,
-                "ABS(100*" + COM_64 + "*[" + R204206 + "])", false, true, false);
+                "100*" + COM_64 + "*[" + R204206 + "]", false, true, false);
         perSpotPbCorrectionsOrdered.add(expression4corCom206);
 
         Expression expression7corCom206 = buildExpression(PB7CORR + COM206PB_PCT,
-                "ABS(100*" + COM_64 + "*[\"" + PB7CORR + R204PB_206PB + "\"])", false, true, false);
+                "100*" + COM_64 + "*[\"" + PB7CORR + R204PB_206PB + "\"]", false, true, false);
         perSpotPbCorrectionsOrdered.add(expression7corCom206);
 
         Expression expression8corCom206 = buildExpression(PB8CORR + COM206PB_PCT,
-                "ABS(100*" + COM_64 + "*[\"" + PB8CORR + R204PB_206PB + "\"])", false, true, false);
+                "100*" + COM_64 + "*[\"" + PB8CORR + R204PB_206PB + "\"]", false, true, false);
         perSpotPbCorrectionsOrdered.add(expression8corCom206);
 
         Expression expression4corCom208 = buildExpression(PB4CORR + COM208PB_PCT,
-                "ABS(100*" + COM_84 + "/[" + R208206 + "]*[" + R204206 + "])", false, true, false);
+                "100*" + COM_84 + "/[" + R208206 + "]*[" + R204206 + "]", false, true, false);
         perSpotPbCorrectionsOrdered.add(expression4corCom208);
 
         Expression expression7corCom208 = buildExpression(PB7CORR + COM208PB_PCT,
-                "ABS(100*" + COM_84 + "/[" + R208206 + "]*[\"" + PB7CORR + R204PB_206PB + "\"])", false, true, false);
+                "100*" + COM_84 + "/[" + R208206 + "]*[\"" + PB7CORR + R204PB_206PB + "\"]", false, true, false);
         perSpotPbCorrectionsOrdered.add(expression7corCom208);
 
         // The next step is to calculate all the applicable radiogenic 208Pb/206Pb values. 

squidCore/src/main/java/org/cirdles/squid/tasks/expressions/functions/Abs.java

@@ -61,7 +61,6 @@ public Object[][] eval(
         try {
             double number = convertObjectArrayToDoubles(childrenET.get(0).eval(shrimpFractions, task)[0])[0];
             retVal = StrictMath.abs(number);
-            ;
         } catch (SquidException se) {
             retVal = 0.0;
         }

squidCore/src/main/java/org/cirdles/squid/utilities/FileUtilities.java

@@ -5,19 +5,14 @@
  */
 package org.cirdles.squid.utilities;
 
-import com.google.common.io.ByteStreams;
-import com.google.common.io.FileWriteMode;
+import org.apache.poi.util.IOUtils;
 
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStreamReader;
+import java.io.*;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Comparator;
 import java.util.Enumeration;
 import java.util.zip.ZipEntry;
-import java.util.zip.ZipException;
 import java.util.zip.ZipFile;
 
 /**
@@ -86,19 +81,26 @@ public static boolean isFileClosedUnix(File file) {
     }
 
     public static void unpackZipFile(final File archive, final File targetDirectory)
-            throws ZipException, IOException {
+            throws IOException {
         ZipFile zipFile = new ZipFile(archive);
         Enumeration<? extends ZipEntry> entries = zipFile.entries();
+        // Dec 2021 this fix comes from https://cwe.mitre.org/data/definitions/23.html and SNYK CODE
+        // via https://app.snyk.io/org/bowring/project/7dd848fc-362b-4514-a91c-3c04628633ac
         while (entries.hasMoreElements()) {
-            final ZipEntry zipEntry = entries.nextElement();
-            if (zipEntry.isDirectory()) {
-                continue;
+            ZipEntry entry = entries.nextElement();
+            Path entryPath = targetDirectory.toPath().resolve(entry.getName());
+            if (!entryPath.normalize().startsWith(targetDirectory.toPath()))
+                throw new IOException("Zip entry contained path traversal");
+            if (entry.isDirectory()) {
+                Files.createDirectories(entryPath);
+            } else {
+                Files.createDirectories(entryPath.getParent());
+                try (InputStream in = zipFile.getInputStream(entry)) {
+                    try (OutputStream out = new FileOutputStream(entryPath.toFile())) {
+                        IOUtils.copy(in, out);
+                    }
+                }
             }
-            final File targetFile = new File(targetDirectory,
-                    zipEntry.getName());
-            com.google.common.io.Files.createParentDirs(targetFile);
-            ByteStreams.copy(zipFile.getInputStream(zipEntry),
-                    com.google.common.io.Files.asByteSink(targetFile, FileWriteMode.APPEND).openStream());
         }
     }
 }

squidCore/src/main/java/org/cirdles/squid/utilities/fileUtilities/ZipUtility.java

@@ -15,9 +15,12 @@
  */
 package org.cirdles.squid.utilities.fileUtilities;
 
-import java.io.*;
+import org.cirdles.squid.utilities.FileUtilities;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
 import java.net.URI;
-import java.nio.file.FileSystem;
 import java.nio.file.*;
 import java.util.Collections;
 import java.util.HashMap;
@@ -60,7 +63,7 @@ public void accept(Path entry) {
                 try {
                     Files.copy(entry, zipFileFileSystem.getPath(level + entry.getFileName()));
 
-                    if (Files.isDirectory(entry, new LinkOption[]{})) {
+                    if (Files.isDirectory(entry)) {
                         zipDirectoryOrFile(level + entry.getFileName() + "/", entry, zipFileFileSystem);
                     }
                 } catch (IOException iOException) {
@@ -70,38 +73,15 @@ public void accept(Path entry) {
     }
 
     public static Path extractZippedFile(File inFile, File destination) throws IOException {
-        File outFile = null;
-        OutputStream out = null;
         Path retVal = null;
         try (ZipInputStream zis = new ZipInputStream(new FileInputStream(inFile))) {
-            //open infile for reading
-            ZipEntry entry;
-
-            //checks first entry exists
-            if ((entry = zis.getNextEntry()) != null) {
-                String outFilename = entry.getName();
-                outFile = new File(destination, outFilename);
-
-                try {
-                    //open outFile for writing
-                    out = new FileOutputStream(outFile);
-                    byte[] buff = new byte[2048];
-                    int len;
-
-                    while ((len = zis.read(buff)) > 0) {
-                        out.write(buff, 0, len);
-                    }
-                } finally {
-                    //close outFile
-                    if (out != null) {
-                        out.close();
-                        retVal = Paths.get(outFile.getPath());
-                    }
-                }
+            ZipEntry zipEntry;
+            if ((zipEntry = zis.getNextEntry()) != null) {
+                File outDirectory = new File(destination.getPath());
+                FileUtilities.unpackZipFile(inFile, outDirectory);
+                retVal = Paths.get(outDirectory.getPath() + File.separator + zipEntry);
             }
         }
-
         return retVal;
-
     }
 }