From 8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72 Mon Sep 17 00:00:00 2001 From: Decebal Suiu Date: Wed, 16 Aug 2023 21:00:59 +0300 Subject: Add security checks to prevent directory traversal when decompressing (#538) --- pf4j/src/main/java/org/pf4j/util/Unzip.java | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'pf4j/src/main/java') diff --git a/pf4j/src/main/java/org/pf4j/util/Unzip.java b/pf4j/src/main/java/org/pf4j/util/Unzip.java index 198cf7d..a78cf83 100644 --- a/pf4j/src/main/java/org/pf4j/util/Unzip.java +++ b/pf4j/src/main/java/org/pf4j/util/Unzip.java @@ -15,17 +15,17 @@ */ package org.pf4j.util; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + import java.io.File; import java.io.FileInputStream; -import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; import java.util.zip.ZipEntry; +import java.util.zip.ZipException; import java.util.zip.ZipInputStream; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - /** * This class extracts the content of the plugin zip into a directory. * It's a class for only the internal use. @@ -75,11 +75,17 @@ public class Unzip { FileUtils.delete(destination.toPath()); } + String destinationCanonicalPath = destination.getCanonicalPath(); try (ZipInputStream zipInputStream = new ZipInputStream(new FileInputStream(source))) { ZipEntry zipEntry; while ((zipEntry = zipInputStream.getNextEntry()) != null) { File file = new File(destination, zipEntry.getName()); + String fileCanonicalPath = file.getCanonicalPath(); + if (!fileCanonicalPath.startsWith(destinationCanonicalPath)) { + throw new ZipException("The file "+ zipEntry.getName() + " is trying to leave the target output directory of "+ destination); + } + // create intermediary directories - sometimes zip don't add them File dir = new File(file.getParent()); -- cgit v1.2.3