Skip to content

Commit

Permalink
#400 Minor improvement to canonical path check
Browse files Browse the repository at this point in the history
  • Loading branch information
srikanth-lingala committed Mar 9, 2022
1 parent 34f3e35 commit db41e9b
Showing 1 changed file with 15 additions and 13 deletions.
28 changes: 15 additions & 13 deletions src/main/java/net/lingala/zip4j/tasks/AbstractExtractFileTask.java
Original file line number Diff line number Diff line change
Expand Up @@ -48,17 +48,7 @@ protected void extractFile(ZipInputStream zipInputStream, FileHeader fileHeader,
File outputFile = determineOutputFile(fileHeader, outputPath, newFileName);
progressMonitor.setFileName(outputFile.getAbsolutePath());

String outputFileCanonicalPath = outputFile.getCanonicalPath();
if (isRelativeRootDirectory(fileHeader.getFileName()) && !outputFileCanonicalPath.endsWith(FILE_SEPARATOR)) {
outputFileCanonicalPath = outputFileCanonicalPath + File.separator;
}

// make sure no file is extracted outside of the target directory (a.k.a zip slip)
String outputCanonicalPath = (new File(outputPath).getCanonicalPath()) + File.separator;
if (!outputFileCanonicalPath.startsWith(outputCanonicalPath)) {
throw new ZipException("illegal file name that breaks out of the target directory: "
+ fileHeader.getFileName());
}
assertCanonicalPathsAreSame(outputFile, outputPath, fileHeader);

verifyNextEntry(zipInputStream, fileHeader);

Expand All @@ -78,8 +68,20 @@ protected void extractFile(ZipInputStream zipInputStream, FileHeader fileHeader,
UnzipUtil.applyFileAttributes(fileHeader, outputFile);
}

private boolean isRelativeRootDirectory(String outputFileName) {
return "/".equals(outputFileName);
private void assertCanonicalPathsAreSame(File outputFile, String outputPath, FileHeader fileHeader)
throws IOException {

String outputFileCanonicalPath = outputFile.getCanonicalPath();
if (outputFile.isDirectory() && !outputFileCanonicalPath.endsWith(FILE_SEPARATOR)) {
outputFileCanonicalPath = outputFileCanonicalPath + FILE_SEPARATOR;
}

// make sure no file is extracted outside the target directory (a.k.a. zip slip)
String outputCanonicalPath = (new File(outputPath).getCanonicalPath()) + File.separator;
if (!outputFileCanonicalPath.startsWith(outputCanonicalPath)) {
throw new ZipException("illegal file name that breaks out of the target directory: "
+ fileHeader.getFileName());
}
}

private boolean isSymbolicLink(FileHeader fileHeader) {
Expand Down

0 comments on commit db41e9b

Please sign in to comment.