7

How can I safely and quickly repack a zip archive to a 7zip archive?

I checked options of 7zip program but I don't see any option to repack. I know I can extract to directory and then pack this directory but is it safe? What if ZIP has paths like "../../file.exe" or "/etc/bin/file.exe"?

I tried unpacking files to stdout and while program 7zip can do this it outputs just content of files without their names etc. so I cannot just grab this output and redirect somewhere to pack into a 7zip archive.

Tom
  • 227
  • 3
  • 8

2 Answers2

4

You could also simply use the arepack tool that's part of the atool suite of tools. It's typically a yum install atool or apt-get install atool to install it. Once this is available you can simply do this:

$ arepack -e -F 7z *.zip

This will convert all the .zip files as .7z files. You'll still need to delete the *.zip files, but that can be done simply like so:

$ rm -f *.zip

Additional arepack options

Options:
  -e, --each               execute command above for each file specified
  -F, --format=EXT         override archive format (see below)
  -O, --format-option=OPT  give specific options to the archiver
  -D, --subdir             always create subdirectory when extracting
  -f, --force              allow overwriting of local files
  -q, --quiet              decrease verbosity level by one
  -v, --verbose            increase verbosity level by one
  -V, --verbosity=LEVEL    specify verbosity (0, 1 or 2)
  -p, --page               send output through pager
  -0, --null               filenames from standard in are null-byte separated
  -E, --explain            explain what is being done by atool
  -S, --simulate           simulation mode - no filesystem changes are made
  -o, --option=KEY=VALUE   override a configuration option
      --config=FILE        load configuration defaults from file

Archive format (for --format) may be specified either as a
file extension ("tar.gz") or as "tar+gzip".
slm
  • 363,520
  • 117
  • 767
  • 871
  • 1
    Seems like it uses temporary folders as well, but probably still more elegant than the shell script. On Ubuntu I also had to `apt install p7zip-full`. – mwfearnley Aug 11 '20 at 08:39
2

You'll need to extract them to a temporary directory.

According to unzip (1),

For security reasons, unzip normally removes "parent dir" path components ("../") from the names of extracted file. This safety feature (new for version 5.50) prevents unzip from accidentally writing files to "sensitive" areas outside the active extraction folder tree head.

So while it is likely safe, your resulting 7z might have the files arranged differently, or even missing if filenames are duplicated.

Here's an example script, but it ignores the .. and absolute path issues:

#!/bin/sh
set -e
if [ "$1" == "" -o "$2" == "" ]
then
    echo Usage: $0 archive.zip archive.7z
    exit 1
fi
scratch=`mktemp -d`
trap "rm -rf $scratch" EXIT
in=`readlink -f $1`
out=`readlink -f $2`
if [ -f $out ]
then
    echo $out exists.
    exit 2
fi
unzip -d"$scratch" "$in"
cd "$scratch"
7z a "$out" .
rrauenza
  • 679
  • 4
  • 9
  • Thank you. This is not a perfect solution (missing files) but it's the best I have right now. So thanks a lot! – Tom May 16 '17 at 20:09