refactor(ZipFolder): fix zip slip issue (#4199)

INRIA · Oct 5, 2021 · 71f08a6 · 71f08a6
1 parent 90e7063
commit 71f08a6
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/main/java/spoon/support/compiler/ZipFolder.java b/src/main/java/spoon/support/compiler/ZipFolder.java
@@ -22,6 +22,7 @@
 import java.util.zip.ZipInputStream;
 
 import spoon.Launcher;
+import spoon.SpoonException;
 import spoon.compiler.SpoonFile;
 import spoon.compiler.SpoonFolder;
 import spoon.compiler.SpoonResourceHelper;
@@ -167,6 +168,10 @@ public void extract(File destDir) {
 			ZipEntry entry;
 			while ((entry = zipInput.getNextEntry()) != null) {
 				File f = new File(destDir + File.separator + entry.getName());
+				if (!f.toPath().normalize().startsWith(destDir.toPath())) {
+					// test against zip slips
+						throw new SpoonException("Entry is outside of the target dir: " + entry.getName());
+				}
 				if (entry.isDirectory()) { // if it's a directory, create it
 					f.mkdir();
 					continue;