@Test public void goodExtractTest() throws Exception { File base = new File("target/test"); base.mkdirs(); File goodKarFile = new File(base, "good.kar"); ZipOutputStream zos = new ZipOutputStream(new FileOutputStream(goodKarFile)); ZipEntry entry = new ZipEntry("foo.bar"); zos.putNextEntry(entry); byte[] data = "Test Data".getBytes(); zos.write(data, 0, data.length); zos.closeEntry(); zos.close(); JarInputStream jis = new JarInputStream(new FileInputStream(goodKarFile)); FileUtil.unjar(jis, base); goodKarFile.delete(); }
public static void unjar(JarInputStream jis, File dir) throws IOException { byte[] buffer = new byte[4096]; for (JarEntry je = jis.getNextJarEntry(); je != null; je = jis.getNextJarEntry()) { if (je.getName().startsWith("/")) { throw new IOException("JAR resource cannot contain absolute paths."); } File target = new File(dir, je.getName()); if (!target.getCanonicalPath().startsWith(dir.getCanonicalPath())) { throw new IOException("JAR resource cannot contain paths with .. characters"); } if (je.isDirectory()) { if (!target.exists()) { if (!target.mkdirs()) { throw new IOException("Unable to create target directory: " + target); } } continue; } int lastIndex = je.getName().lastIndexOf('/'); String name = (lastIndex >= 0) ? je.getName().substring(lastIndex + 1) : je.getName(); String destination = (lastIndex >= 0) ? je.getName().substring(0, lastIndex) : ""; destination = destination.replace('/', File.separatorChar); copy(jis, dir, name, destination, buffer); } }
FileUtil { public static void unjar(JarInputStream jis, File dir) throws IOException { byte[] buffer = new byte[4096]; for (JarEntry je = jis.getNextJarEntry(); je != null; je = jis.getNextJarEntry()) { if (je.getName().startsWith("/")) { throw new IOException("JAR resource cannot contain absolute paths."); } File target = new File(dir, je.getName()); if (!target.getCanonicalPath().startsWith(dir.getCanonicalPath())) { throw new IOException("JAR resource cannot contain paths with .. characters"); } if (je.isDirectory()) { if (!target.exists()) { if (!target.mkdirs()) { throw new IOException("Unable to create target directory: " + target); } } continue; } int lastIndex = je.getName().lastIndexOf('/'); String name = (lastIndex >= 0) ? je.getName().substring(lastIndex + 1) : je.getName(); String destination = (lastIndex >= 0) ? je.getName().substring(0, lastIndex) : ""; destination = destination.replace('/', File.separatorChar); copy(jis, dir, name, destination, buffer); } } }
FileUtil { public static void unjar(JarInputStream jis, File dir) throws IOException { byte[] buffer = new byte[4096]; for (JarEntry je = jis.getNextJarEntry(); je != null; je = jis.getNextJarEntry()) { if (je.getName().startsWith("/")) { throw new IOException("JAR resource cannot contain absolute paths."); } File target = new File(dir, je.getName()); if (!target.getCanonicalPath().startsWith(dir.getCanonicalPath())) { throw new IOException("JAR resource cannot contain paths with .. characters"); } if (je.isDirectory()) { if (!target.exists()) { if (!target.mkdirs()) { throw new IOException("Unable to create target directory: " + target); } } continue; } int lastIndex = je.getName().lastIndexOf('/'); String name = (lastIndex >= 0) ? je.getName().substring(lastIndex + 1) : je.getName(); String destination = (lastIndex >= 0) ? je.getName().substring(0, lastIndex) : ""; destination = destination.replace('/', File.separatorChar); copy(jis, dir, name, destination, buffer); } }  }
FileUtil { public static void unjar(JarInputStream jis, File dir) throws IOException { byte[] buffer = new byte[4096]; for (JarEntry je = jis.getNextJarEntry(); je != null; je = jis.getNextJarEntry()) { if (je.getName().startsWith("/")) { throw new IOException("JAR resource cannot contain absolute paths."); } File target = new File(dir, je.getName()); if (!target.getCanonicalPath().startsWith(dir.getCanonicalPath())) { throw new IOException("JAR resource cannot contain paths with .. characters"); } if (je.isDirectory()) { if (!target.exists()) { if (!target.mkdirs()) { throw new IOException("Unable to create target directory: " + target); } } continue; } int lastIndex = je.getName().lastIndexOf('/'); String name = (lastIndex >= 0) ? je.getName().substring(lastIndex + 1) : je.getName(); String destination = (lastIndex >= 0) ? je.getName().substring(0, lastIndex) : ""; destination = destination.replace('/', File.separatorChar); copy(jis, dir, name, destination, buffer); } }  static void downloadSource(
        PrintStream out, PrintStream err,
        URL srcURL, String dirStr, boolean extract); static void unjar(JarInputStream jis, File dir); static void copy(
        InputStream is, File dir, String destName, String destDir, byte[] buffer); }
FileUtil { public static void unjar(JarInputStream jis, File dir) throws IOException { byte[] buffer = new byte[4096]; for (JarEntry je = jis.getNextJarEntry(); je != null; je = jis.getNextJarEntry()) { if (je.getName().startsWith("/")) { throw new IOException("JAR resource cannot contain absolute paths."); } File target = new File(dir, je.getName()); if (!target.getCanonicalPath().startsWith(dir.getCanonicalPath())) { throw new IOException("JAR resource cannot contain paths with .. characters"); } if (je.isDirectory()) { if (!target.exists()) { if (!target.mkdirs()) { throw new IOException("Unable to create target directory: " + target); } } continue; } int lastIndex = je.getName().lastIndexOf('/'); String name = (lastIndex >= 0) ? je.getName().substring(lastIndex + 1) : je.getName(); String destination = (lastIndex >= 0) ? je.getName().substring(0, lastIndex) : ""; destination = destination.replace('/', File.separatorChar); copy(jis, dir, name, destination, buffer); } }  static void downloadSource(
        PrintStream out, PrintStream err,
        URL srcURL, String dirStr, boolean extract); static void unjar(JarInputStream jis, File dir); static void copy(
        InputStream is, File dir, String destName, String destDir, byte[] buffer);  }