Fixing potential Zip Slip Vulnerability, see
@@ -110,7 +110,12 @@ public static void unzip(InputStream source, File outputDir) throws IOException
}
public static void unzipFile(File output, InputStream zipStream, String name) throws IOException {
+ String canonicalDestinationDirPath = output.getCanonicalPath();
File toWrite = new File(output, name);
+ String canonicalDestinationFile = toWrite.getCanonicalPath();
+ if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator)) {
+ throw new IOException("Entry is outside of the target dir: " + name);
+ }
if (!FileHandler.createDir(toWrite.getParentFile()))
throw new IOException("Cannot create parent directory for: " + name);
