Using jszip library to decompress zip with password reports an error

Read the original article：Using jszip library to decompress zip with password reports an error

Using jszip library to decompress zip with password reports an error

Problem description

Import the jszip library and use the following code to decompress the encrypted zip file. An error is reported during the decompression process:

 export class ZipFileUtil {
   static unzipFile(context: common.UIAbilityContext) {
     let zipFilePath = context.cacheDir + "/******.zip"
     const jszip = new JSZip();
     jszip.loadAsync(zipFilePath,{
       password: '********'
     }).then((data: JSZip) => {
       LogUtil.error(`Decompress and decrypt the file successfully ${JSON.stringify(data)}`)
     }).catch((err: Error) => {
       LogUtil.error(`Failed to decompress the encrypted file! Error reason: ${err.message}`)
     })
   }
 }

The error content is as follows:

1 ERROR: ArkTS:ERROR Failed to resolve OhmUrl.
Error Message: Failed to get a resolved OhmUrl for "hvigor_ignore_C:_work_DevEco_xxproject_********_oh_modules_.ohpm_@ohos+jszip@1.0.0_oh_modules_@ohos_jszip_src_main_type_index.d.ts" imported by "C:\work\DevEco\xxproject\*******\entry\src\main\ets\util\ZipFileUtil.ets".
* Try the following:
Check whether the module which hvigor_ignore_C:_work_DevEco_xxproject_*****_oh_modules_.ohpm_@ohos+jszip@1.0.0_oh_modules_@ohos_jszip_src_main_type_index.d.ts belongs to is correctly configured.
Check the corresponding file name is [jszip](https://github.com/Stuk/jszip)correct(including case-sensitivity).

Background knowledge

jszip is a widely used zip library on the node.js platform.

Main functions:

Create compressed files: With jszip, you can dynamically generate zip files on the client side and include multiple files and folders.
Read compressed files: You can read and parse the contents of zip files in the browser, including the structure and data of files and folders.
Modify compressed files: jszip allows you to add, update, or delete files and folders to existing ZIP files.
Compress and decompress data: jszip can not only process files, but also be used to compress and decompress data, such as JSON, text, etc.
Support asynchronous operations: jszip supports asynchronous operations, which is particularly useful when processing large compressed files to avoid blocking the user interface.

HarmonyOS has newly added the ability to decompress zip files with passwords. The third-party library HarmonyOS version is hosted on OpenHarmony Third-party Library Central Warehouse.

Positioning ideas

After decompression, the error message "Encrypted zip: unsupported encrypt method" is displayed:

Suspected that the encryption algorithm of the compressed file does not match, tracing the encrypted file, it is a zip file directly compressed by zip -e in the console on a MAC computer, and the encryption algorithm is PKZIP 2.0.

After research:

PKZIP 2.0 is not secure and can be easily cracked. See What encryption method is used by the zip program in macOS? - Information Security Stack Exchange.

jszip has no plans to support PKZIP 2.0, and the reason is also security reasons. jszip uses AES encryption (Advanced Encryption Standard, 1|2|3, default 3 (AES-256)).

Solution

@ohos/jszip is transplanted from the js library jszip, and the original library itself does not support PKZIP 2.0 encryption.

Research has found that minizip currently still supports PKZIP 2.0 algorithm encryption and decryption.

Please note that minizip needs to be run on a real machine.

 import { unzipToDirectory } from '@ohos/minizip';
 unzipToDirectory(selectFilePath, targetPath, '********').then(() => {
   LogUtil.error('Decompression successful')
}).catch(() => {
   LogUtil.error('Decompression failed')
 });

Summary

The encryption algorithm of the zip file obtained by directly compressing it using zip -e in the console on a MAC computer is PKZIP 2.0.

You need to use minizip to decrypt the compressed package encrypted by PKZIP 2.0. jszip only supports AES algorithm encryption and decryption.

Written by Emine Inan