Add separator to zip slip check - fixes
@@ -460,11 +460,11 @@ public class ImportingUtilities {
File file = new File(dir, name);
// For CVE-2018-19859, issue #1840
- if (!file.toPath().normalize().startsWith(dir.toPath().normalize())) {
+ if (!file.toPath().normalize().startsWith(dir.toPath().normalize() + File.separator)) {
throw new IllegalArgumentException("Zip archives with files escaping their root directory are not allowed.");
}
- int dot = name.indexOf('.');
+ int dot = name.lastIndexOf('.');
String prefix = dot < 0 ? name : name.substring(0, dot);
String suffix = dot < 0 ? "" : name.substring(dot);
int index = 2;
