ZipUtil { public static void extract(File zipFile, File destDir) throws IOException { try (ZipFile zf = new ZipFile(zipFile)) { extract(zf, destDir); } }  static boolean isZipStream(InputStream in); static void extract(File zipFile, File destDir); static void extract(ZipFile zipFile, File destDir); static void writeEntry(ZipFile zipFile, ZipEntry entry, File destDir);  }
@Test public void testWriteEntryNormal() throws IOException { File f = dir.newFile("testok.zip"); try (ZipOutputStream out = new ZipOutputStream(new FileOutputStream(f))) { ZipEntry e = new ZipEntry("helloworld.txt"); out.putNextEntry(e); out.write("hello world".getBytes()); out.closeEntry(); } ZipFile zf = new ZipFile(f); File subdir = dir.newFolder("extract"); ZipUtil.extract(zf, subdir); assertTrue("File not extracted", new File(subdir, "helloworld.txt").exists()); }
@Test public void testWriteEntryPathTraversing() throws IOException { File f = dir.newFile("testnotok.zip"); try (ZipOutputStream out = new ZipOutputStream(new FileOutputStream(f))) { ZipEntry e = new ZipEntry("hello/../../world.txt"); out.putNextEntry(e); out.write("hello world".getBytes()); out.closeEntry(); } ZipFile zf = new ZipFile(f); File subdir = dir.newFolder("extract"); try { ZipUtil.extract(zf, subdir); fail("No exception thrown"); } catch (IOException ioe) { assertTrue(ioe.getMessage().startsWith("Zip entry outside destination directory")); } }