1 <?xml version="1.0"?> 2 <!-- 3 Licensed to the Apache Software Foundation (ASF) under one or more 4 contributor license agreements. See the NOTICE file distributed with 5 this work for additional information regarding copyright ownership. 6 The ASF licenses this file to You under the Apache License, Version 2.0 7 (the "License"); you may not use this file except in compliance with 8 the License. You may obtain a copy of the License at 9 10 http://www.apache.org/licenses/LICENSE-2.0 11 12 Unless required by applicable law or agreed to in writing, software 13 distributed under the License is distributed on an "AS IS" BASIS, 14 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 See the License for the specific language governing permissions and 16 limitations under the License. 17 --> 18 <document> 19 <properties> 20 <title>Known Limitations and Problems</title> 21 </properties> 22 23 <body> 24 <p>This page lists the known limitations and problems of Apache 25 Commons Compress™ grouped by the archiving/compression 26 format they apply to.</p> 27 28 <section name="General"> 29 <ul> 30 <li>Several implementations of decompressors and unarchivers will 31 invoke <a 32 href="https://docs.oracle.com/javase/10/docs/api/java/io/InputStream.html#skip(long)"><code>skip</code></a> 33 on the underlying <code>InputStream</code> which may throw an 34 <code>IOException</code> in some stream implementations. One 35 known case where this happens is when using 36 <code>System.in</code> as input. If you encounter an 37 exception with a message like "Illegal seek" we recommend you 38 wrap your stream in a <code>SkipShieldingInputStream</code> 39 from our utils package before passing it to Compress.</li> 40 </ul> 41 </section> 42 43 <section name="7Z"> 44 <ul> 45 <li>the format requires the otherwise optional <a 46 href="https://tukaani.org/xz/java.html">XZ for Java</a> 47 library.</li> 48 <li>only <code>File</code>s are supported as input/output, 49 not streams. Starting with Compress 1.13 50 <code>SeekableByteChannel</code> is supported as well.</li> 51 <li>In Compress 1.7 52 <code>ArchiveStreamFactory</code> will not auto-detect 7z 53 archives, starting with 1.8 it will throw a 54 <code>StreamingNotSupportedException</code> when reading from 55 a 7z archive.</li> 56 <li>Encryption, solid compression and header compression and 57 are only supported when reading archives</li> 58 <li>Commons Compress 1.12 and earlier didn't support writing 59 LZMA.</li> 60 <li>Several of the "methods" supported by 7z are not 61 implemented in Compress.</li> 62 <li>No support for multi-volume archives</li> 63 <li>Support for some BCJ filters and the DELTA filter has 64 been added with Compress 1.8. Because of a known bug in 65 version 1.4 of the <a 66 href="https://tukaani.org/xz/java.html">XZ for Java</a> 67 library, archives using BCJ filters will cause an 68 <code>AssertionError</code> when read. If you need support 69 for BCJ filters you must use XZ for Java 1.5 or later.</li> 70 </ul> 71 </section> 72 <section name="AR"> 73 <ul> 74 <li>AR archives can not contain directories - this is a 75 limitation of the format rather than one of Compress' 76 implementation.</li> 77 <li>file names longer than 16 characters are only fully 78 supported using the BSD dialect, the GNU/SRV4 dialect is only 79 supported when reading archives.</li> 80 </ul> 81 </section> 82 <section name="ARJ"> 83 <ul> 84 <li>read-only support</li> 85 <li>no support for compression, encryption or multi-volume 86 archives</li> 87 </ul> 88 </section> 89 <section name="Brotli"> 90 <ul> 91 <li>the format requires the otherwise optional <a 92 href="https://github.com/google/brotli">Google Brotli dec</a> 93 library.</li> 94 <li>read-only support</li> 95 <li><code>CompressorStreamFactory</code> is not able to auto-detect 96 streams using Brotli compression.</li> 97 </ul> 98 </section> 99 <section name="BZIP2"> 100 <p>Versions of Compress prior to 1.4.1 are vulnerable to a 101 possible denial of service attack, see the <a 102 href="security.html">Security Reports</a> page for details.</p> 103 </section> 104 <section name="CPIO"> 105 <p>We are not aware of any problems.</p> 106 </section> 107 <section name="DEFLATE"> 108 <ul> 109 <li><code>CompressorStreamFactory</code> is not able to auto-detect 110 streams using DEFLATE compression.</li> 111 </ul> 112 </section> 113 <section name="DEFLATE64"> 114 <ul> 115 <li><code>CompressorStreamFactory</code> is not able to auto-detect 116 streams using DEFLATE64 compression.</li> 117 <li>read-only support</li> 118 </ul> 119 </section> 120 <section name="DUMP"> 121 <ul> 122 <li>read-only support</li> 123 <li>only the new-fs format is supported</li> 124 <li>the only compression algorithm supported is zlib</li> 125 </ul> 126 </section> 127 <section name="GZIP"> 128 <p>We are not aware of any problems.</p> 129 </section> 130 <section name="JAR"> 131 <p>JAR archives are special ZIP archives, all limitations of <a 132 href="#ZIP">ZIP</a> apply to JAR as well.</p> 133 <ul> 134 <li><code>ArchiveStreamFactory</code> cannot tell JAR 135 archives from ZIP archives and will not auto-detect 136 JARs.</li> 137 <li>Compress doesn't provide special access to the archive's 138 MANIFEST</li> 139 </ul> 140 </section> 141 <section name="LZ4"> 142 <ul> 143 <li>In theory LZ4 compressed streams can contain literals and 144 copies of arbitrary length while Commons Compress only 145 supports sizes up to 2<sup>63</sup> - 1 (i.e. ≈ 9.2 146 EB).</li> 147 </ul> 148 </section> 149 <section name="LZMA"> 150 <ul> 151 <li>the format requires the otherwise optional <a 152 href="https://tukaani.org/xz/java.html">XZ for Java</a> 153 library.</li> 154 <li>Commons Compress 1.12 and earlier only support reading 155 the format</li> 156 </ul> 157 </section> 158 <section name="PACK200"> 159 <p>We are not aware of any problems.</p> 160 </section> 161 <section name="SNAPPY"> 162 <ul> 163 <li>Commons Compress 1.13 and earlier only support reading 164 the format</li> 165 </ul> 166 </section> 167 <section name="TAR"> 168 <ul> 169 <li>sparse files can neither be read nor written</li> 170 <li>only a subset of the GNU and POSIX extensions are 171 supported</li> 172 <li>In Compress 1.6 <code>TarArchiveInputStream</code> could 173 fail to read the full contents of an entry unless the stream 174 was wrapped in a buffering stream.</li> 175 </ul> 176 </section> 177 <section name="XZ"> 178 <ul> 179 <li>the format requires the otherwise optional <a 180 href="https://tukaani.org/xz/java.html">XZ for Java</a> 181 library.</li> 182 </ul> 183 </section> 184 <section name="Z"> 185 <ul> 186 <li>Prior to Compress 1.8.1 187 <code>CompressorStreamFactory</code> was not able to 188 auto-detect streams using .Z compression.</li> 189 <li>read-only support</li> 190 </ul> 191 </section> 192 <section name="ZIP"> 193 <ul> 194 <li><code>ZipArchiveInputStream</code> is limited and may 195 even return false contents in some cases, use 196 <code>ZipFile</code> whenever possible. See <a 197 href="zip.html#ZipArchiveInputStream_vs_ZipFile">the ZIP 198 documentation page</a> for details. This limitation is a 199 result of streaming data vs using random access and not a 200 limitation of Compress' specific implementation.</li> 201 <li>only a subset of compression methods are supported, 202 including the most common STORED and DEFLATEd. IMPLODE, 203 SHRINK, DEFLATE64 and BZIP2 support is read-only.</li> 204 <li>no support for encryption or multi-volume archives</li> 205 <li>In versions prior to Compress 1.6 206 <code>ZipArchiveEntries</code> read from an archive will 207 contain non-zero millisecond values when using Java8 rather 208 than the expected two-second granularity.</li> 209 <li>Compress 1.7 has a known bug where the very first entry 210 of an archive will not be read correctly by 211 <code>ZipArchiveInputStream</code> if it used the STORED 212 method.</li> 213 <li><code>ZipArchiveEntry#getLastModifiedDate</code> uses 214 <code>ZipEntry#getTime</code> under the covers which may 215 return different times for the same archive when using 216 different versions of Java.</li> 217 <li>In versions of Compress prior to 1.16 a specially crafted 218 ZIP archive can be used to cause an infinite loop inside of 219 Compress' extra field parser used by the <code>ZipFile</code> 220 and <code>ZipArchiveInputStream</code> classes. This can be 221 used to mount a denial of service attack against services 222 that use Compress' zip package. See the <a 223 href="security.html">Security Reports</a> page for 224 details.</li> 225 </ul> 226 </section> 227 <section name="Zstandard"> 228 <ul> 229 <li>the format requires the otherwise optional <a 230 href="https://github.com/luben/zstd-jni">Zstandard JNI</a> 231 library.</li> 232 </ul> 233 </section> 234 </body> 235 </document> 236
