Skip to content

Commit 1ec0265

Browse files
committed
Improve Zip Slip detection
1 parent c968e94 commit 1ec0265

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

src/main/java/the/bytecode/club/bytecodeviewer/util/ZipUtils.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ public final class ZipUtils {
4444
* @throws IOException Signals that an I/O exception has occurred.
4545
*/
4646
public static void unzipFilesToPath(String jarPath, String destinationDir) throws IOException {
47+
String canonicalDestDir = new File(destinationDir).getCanonicalPath();
48+
if (!canonicalDestDir.endsWith(File.separator)) {
49+
canonicalDestDir += File.separator;
50+
}
51+
4752
File file = new File(jarPath);
4853
try (JarFile jar = new JarFile(file)) {
4954

@@ -68,7 +73,7 @@ public static void unzipFilesToPath(String jarPath, String destinationDir) throw
6873
String fileName = destinationDir + File.separator + entry.getName();
6974
File f = new File(fileName);
7075

71-
if (!f.getCanonicalPath().startsWith(destinationDir)) {
76+
if (!f.getCanonicalPath().startsWith(canonicalDestDir)) {
7277
System.out.println("Zip Slip exploit detected. Skipping entry " + entry.getName());
7378
continue;
7479
}

0 commit comments

Comments
 (0)