Merge pull request #103 from BulkSecurityGeneratorProjectV2/fix/JLL/z…

…ip-slip-vulnerability [SECURITY] Fix Zip Slip Vulnerability
LEMS · Aug 1, 2022 · 3e78551 · 3e78551
2 parents a1c2c5a + 8c22463
commit 3e78551
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/main/java/org/lemsml/jlems/io/util/JUtil.java b/src/main/java/org/lemsml/jlems/io/util/JUtil.java
@@ -205,6 +205,9 @@ public static void unpackJar(File fjar, File fout) throws IOException {
       while (en.hasMoreElements()) {
          JarEntry je = en.nextElement();
          java.io.File f = new File(fout,  je.getName());
+							if (!f.toPath().normalize().startsWith(fout.toPath().normalize())) {
+								throw new RuntimeException("Bad zip entry");
+							}
          if (je.isDirectory()) {
             f.mkdirs();
             continue;