fix zip slip
@@ -92,11 +92,12 @@ public class ZipUtils {
if (file.isFile()) {
stream.putNextEntry(new ZipEntry(destPath + file.getName()));
final StreamCopy copy = new StreamCopy();
- final FileInputStream inputStream = new FileInputStream(file);
+ try (final FileInputStream inputStream = new FileInputStream(file)) {
copy.copy(inputStream, stream);
}
}
}
+ }
public static void unzipEntry(String folder, ZipFile zipFile, File destinationFolder)
throws IOException {
@@ -114,6 +115,10 @@ public class ZipUtils {
}
File extractedFile = new File(destinationFolder, entry.getName());
+ if(!extractedFile.toPath().normalize().startsWith(destinationFolder.toPath())) {
+ throw new IllegalArgumentException("Bad zip entry.");
+ }
+
if (entry.isDirectory()) {
extractedFile.mkdirs();
continue;
