zipslip

nosan · Sep 10, 2022 · dcc5818d80489d3ebc2ed4265d673bc05af08551 · dcc5818
1 parent 514fbbb
commit dcc5818d80489d3ebc2ed4265d673bc05af08551
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/src/main/java/com/github/nosan/embedded/cassandra/WebCassandraDirectoryProvider.java b/src/main/java/com/github/nosan/embedded/cassandra/WebCassandraDirectoryProvider.java
 	 * @param destination the directory to which to extract the files (already created)
 	 * @throws IOException an I/O error occurs
 	 */
 	protected void extract(Path archiveFile, Path destination) throws IOException {
 		try (ArchiveInputStream archiveInputStream = createArchiveInputStream(archiveFile)) {
 			ArchiveEntry entry;
 			while ((entry = archiveInputStream.getNextEntry()) != null) {
+				Path entryPath = destination.resolve(entry.getName()).normalize().toAbsolutePath();
+				if (!entryPath.startsWith(destination)) {
+					throw new IOException("Bad zip entry [" + entry.getName() + "]");
+				}
 				if (entry.isDirectory()) {
-					Files.createDirectories(destination.resolve(entry.getName()).normalize().toAbsolutePath());
+					Files.createDirectories(entryPath);
 				}
 				else {
-					Path file = destination.resolve(entry.getName()).normalize().toAbsolutePath();
-					Path parent = file.getParent();
+					Path parent = entryPath.getParent();
 					if (!Files.exists(parent)) {
 						Files.createDirectories(parent);
 					}
-					Files.copy(archiveInputStream, file, StandardCopyOption.REPLACE_EXISTING);
+					Files.copy(archiveInputStream, entryPath, StandardCopyOption.REPLACE_EXISTING);
 				}
 			}
 		}
 	}

 	/**