{"record":{"id":"c8b323ca62f8f6af","repo":"Tencent/tinker","slug":"bad-method-value","errorCode":null,"errorMessage":"Bad method: ${value}","messagePattern":"Bad method: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"third-party/tinker-ziputils/src/main/java/com/tencent/tinker/ziputils/ziputil/TinkerZipEntry.java","lineNumber":314,"sourceCode":"     *         or -1 if the compression method has not been set.\n     */\n    public int getMethod() {\n        return compressionMethod;\n    }\n\n    /**\n     * Sets the compression method for this entry to either {@code DEFLATED} or {@code STORED}.\n     * The default is {@code DEFLATED}, which will cause the size, compressed size, and CRC to be\n     * set automatically, and the entry's data to be compressed. If you switch to {@code STORED}\n     * note that you'll have to set the size (or compressed size; they must be the same, but it's\n     * okay to only set one) and CRC yourself because they must appear <i>before</i> the user data\n     * in the resulting zip file. See {@link #setSize} and {@link #setCrc}.\n     * @throws IllegalArgumentException\n     *             when value is not {@code DEFLATED} or {@code STORED}.\n     */\n    public void setMethod(int value) {\n        if (value != STORED && value != DEFLATED) {\n            throw new IllegalArgumentException(\"Bad method: \" + value);\n        }\n        compressionMethod = value;\n    }\n\n    /**\n     * Gets the name of this {@code ZipEntry}.\n     *\n     * <p><em>Security note:</em> Entry names can represent relative paths. {@code foo/../bar} or\n     * {@code ../bar/baz}, for example. If the entry name is being used to construct a filename\n     * or as a path component, it must be validated or sanitized to ensure that files are not\n     * written outside of the intended destination directory.\n     *\n     * @return the entry name.\n     */\n    public String getName() {\n        return name;\n    }\n","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/Tencent/tinker/blob/1b7ea02c239840f563ea64fb5bd286eb98d4011e/third-party/tinker-ziputils/src/main/java/com/tencent/tinker/ziputils/ziputil/TinkerZipEntry.java#L296-L332","documentation":"setMethod only accepts the two compression methods the zip writer supports: STORED (0, no compression) and DEFLATED (8, default). Any other int — including values that exist in the zip spec but are not implemented here (e.g. BZIP2 12, LZMA 14) or -1 sentinels from other APIs — throws IllegalArgumentException('Bad method'). The guard fires before any state changes, so the entry keeps its previous method.","triggerScenarios":"Calling setMethod(value) with value != TinkerZipEntry.STORED && value != TinkerZipEntry.DEFLATED; passing a method constant from another zip library or a raw central-directory method field for an unsupported algorithm.","commonSituations":"Copying entries verbatim from archives produced by tools that used LZMA/BZIP2/PPMd; mapping java.util.zip constants through a custom int; passing -1 ('not set') read from a partially populated entry.","solutions":["Normalize the method explicitly: entry.setMethod(TinkerZipEntry.DEFLATED) (or STORED) instead of forwarding a foreign constant.","When importing entries from another archive, whitelist STORED/DEFLATED and either decompress-and-rewrite or skip unsupported entries.","If you meant 'not yet set', do not call setMethod at all — DEFLATED is the default."],"exampleFix":"// before\nentry.setMethod(sourceEntry.getMethod()); // may be e.g. 14 (LZMA)\n\n// after\nint m = sourceEntry.getMethod();\nentry.setMethod(m == TinkerZipEntry.STORED ? TinkerZipEntry.STORED : TinkerZipEntry.DEFLATED);","handlingStrategy":"validation","validationCode":"static boolean supportedMethod(int m) {\n    return m == TinkerZipEntry.STORED || m == TinkerZipEntry.DEFLATED;\n}\n\nint m = sourceEntry.getMethod();\nif (!supportedMethod(m)) {\n    m = TinkerZipEntry.DEFLATED; // or skip the entry\n}\nentry.setMethod(m);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist STORED/DEFLATED at the import boundary of your zip-copying code.","Never forward raw method ints from other zip libraries or parsed headers.","Remember -1 means 'unset' elsewhere — map it, do not pass it through."],"tags":["zip","validation","compression","tinker"],"backgroundTag":null,"analyzedSha":"1b7ea02c239840f563ea64fb5bd286eb98d4011e","analyzedAt":"2026-08-14T15:16:52.110Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}