Prevent extracting archived plugins outside of target path
@@ -598,6 +598,10 @@ public final class FilePath implements Serializable {
while (entries.hasMoreElements()) {
ZipEntry e = entries.nextElement();
File f = new File(dir, e.getName());
+ if (!f.toPath().normalize().startsWith(dir.toPath())) {
+ throw new IOException(
+ "Zip " + zipFile.getPath() + " contains illegal file name that breaks out of the target directory: " + e.getName());
+ }
if (e.isDirectory()) {
mkdirs(f);
} else {
