Did this fix a security vulnerability?

[JLLeitschuh]

#400

Reaching out to ask if this fixed a security vulnerability, or was it just a bug? If it was a bug, do you need assistance with vulnerability disclosure and getting a CVE number assigned?

[Marcono1234]

If I understand it correctly, that was only a bug without any security impact.

Zip4j treats an entry with the name / as being the directory to which the files are extracted (so this normally has no effect because that directory already exists). However, the issue was that for the Zip Slip check after resolving the / name the results were:

• outputCanonicalPath: extract-dir/
• outputFile.getCanonicalPath(): extract-dir

So the Zip Slip check performing startsWith was erroneously detecting this as Zip Slip attack.
After the fix it is now extract-dir/ in both cases, so startsWith passes.