ZipUtils { public static void unzip(File archive, File destination) throws IOException { if (archive == null) throw new NullPointerException("The ZIP file can not be null"); if (!archive.exists()) throw new FileNotFoundException("The ZIP file does not exist"); LOGGER.log(FINE, "Extracting file {0}", archive.toURI().toASCIIString()); final FileInputStream inputStream = new FileInputStream(archive); unzip(inputStream, destination); } private  ZipUtils(); static void unzip(File archive, File destination); static void unzip(InputStream archive, File destination); static void zip(File fileToZip, File destination);  }
@Test public void unzip() throws IOException { final File zip = new File(resourcesDir, "archive.zip"); final File unzippedFolder = new File(testResultsDir, "unzipped").toPath().toAbsolutePath().toFile(); if (!unzippedFolder.exists()) unzippedFolder.mkdir(); ZipUtils.unzip(zip, unzippedFolder); File unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "dir").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isDirectory()); unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "dir", "otherDir").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isDirectory()); unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "dir", "otherDir", "otherDirTest.html").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isFile()); unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "dir", "dirTest.txt").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isFile()); unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "test.html").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isFile()); unzippedFile = Paths.get(unzippedFolder.getAbsolutePath(), "test.txt").toFile(); assertTrue(unzippedFile.exists()); assertTrue(unzippedFile.isFile()); Files.walkFileTree(unzippedFolder.toPath(), new DeleteFileVisitor()); }
@Test public void zipSlipVulnerabilityManaged() throws IOException { final File zipFile = new File(testResultsDir, "zipSlipVulnerability.zip"); zipFile.deleteOnExit(); try (final FileOutputStream fileOutputStream = new FileOutputStream(zipFile); final ZipOutputStream outputStream = new ZipOutputStream(fileOutputStream)) { outputStream.putNextEntry(new ZipEntry("../zipSlipFile.txt")); outputStream.write("Zip Slip vulnerability !!!".getBytes(UTF_8)); outputStream.closeEntry(); outputStream.flush(); } final File unzippedFolder = new File(testResultsDir, "zipSlipVulnerability").toPath().toAbsolutePath().toFile(); if (!unzippedFolder.exists()) unzippedFolder.mkdir(); ZipUtils.unzip(zipFile, unzippedFolder); final File unzippedFile = Paths.get(testResultsDir.getAbsolutePath(), "zipSlipFile.txt").toFile(); assertFalse(unzippedFile.exists()); Files.walkFileTree(unzippedFolder.toPath(), new DeleteFileVisitor()); }