package cmd import ( "archive/zip" "bytes" "fmt" "io" "io/ioutil" "log" "net/http" "os" "path/filepath" "strings" ) func RunMizuFetch(fetch *MizuFetchOptions) { resp, err := http.Get(fmt.Sprintf("http://localhost:8899/api/har?limit=%v", fetch.Limit)) if err != nil { log.Fatal(err) } defer func() { _ = resp.Body.Close() }() body, err := ioutil.ReadAll(resp.Body) if err != nil { log.Fatal(err) } zipReader, err := zip.NewReader(bytes.NewReader(body), int64(len(body))) if err != nil { log.Fatal(err) } _ = Unzip(zipReader, fetch.Directory) } func Unzip(reader *zip.Reader, dest string) error { dest, _ = filepath.Abs(dest) _ = os.MkdirAll(dest, os.ModePerm) // Closure to address file descriptors issue with all the deferred .Close() methods extractAndWriteFile := func(f *zip.File) error { rc, err := f.Open() if err != nil { return err } defer func() { if err := rc.Close(); err != nil { panic(err) } }() path := filepath.Join(dest, f.Name) // Check for ZipSlip (Directory traversal) if !strings.HasPrefix(path, filepath.Clean(dest) + string(os.PathSeparator)) { return fmt.Errorf("illegal file path: %s", path) } if f.FileInfo().IsDir() { _ = os.MkdirAll(path, f.Mode()) } else { _ = os.MkdirAll(filepath.Dir(path), f.Mode()) fmt.Print("writing HAR file [ ", path, " ] .. ") f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode()) if err != nil { return err } defer func() { if err := f.Close(); err != nil { panic(err) } fmt.Println(" done") }() _, err = io.Copy(f, rc) if err != nil { return err } } return nil } for _, f := range reader.File { err := extractAndWriteFile(f) if err != nil { return err } } return nil }