@Test public void fail_if_unzipping_file_outside_target_directory() throws Exception { File zip = new File(getClass().getResource("ZipUtilsTest/zip-slip.zip").toURI()); File toDir = temp.newFolder(); try { ZipUtils.javaUnzip(zip, toDir); fail(); } catch (Exception e) { assertThat(e.getCause()).isInstanceOfAny(IllegalStateException.class); assertThat(e.getCause().getMessage()).isEqualTo( "Unzipping an entry outside the target directory is not allowed: ../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/evil.txt"); } }
static void javaUnzip(File zip, File toDir) { Path targetDirNormalizedPath = toDir.toPath().normalize(); try { try (ZipFile zipFile = new ZipFile(zip)) { Enumeration<? extends ZipEntry> entries = zipFile.entries(); while (entries.hasMoreElements()) { ZipEntry entry = entries.nextElement(); File to = targetDirNormalizedPath.resolve(entry.getName()).toFile(); verifyInsideTargetDirectory(entry, to.toPath(), targetDirNormalizedPath); if (entry.isDirectory()) { FileUtils.forceMkdir(to); } else { File parent = to.getParentFile(); if (parent != null) { FileUtils.forceMkdir(parent); } try (OutputStream fos = new BufferedOutputStream(Files.newOutputStream(to.toPath()))) { IOUtils.copy(zipFile.getInputStream(entry), fos); } } } } } catch (Exception e) { throw new IllegalStateException("Fail to unzip " + zip + " to " + targetDirNormalizedPath, e); } }
ZipUtils { static void javaUnzip(File zip, File toDir) { Path targetDirNormalizedPath = toDir.toPath().normalize(); try { try (ZipFile zipFile = new ZipFile(zip)) { Enumeration<? extends ZipEntry> entries = zipFile.entries(); while (entries.hasMoreElements()) { ZipEntry entry = entries.nextElement(); File to = targetDirNormalizedPath.resolve(entry.getName()).toFile(); verifyInsideTargetDirectory(entry, to.toPath(), targetDirNormalizedPath); if (entry.isDirectory()) { FileUtils.forceMkdir(to); } else { File parent = to.getParentFile(); if (parent != null) { FileUtils.forceMkdir(parent); } try (OutputStream fos = new BufferedOutputStream(Files.newOutputStream(to.toPath()))) { IOUtils.copy(zipFile.getInputStream(entry), fos); } } } } } catch (Exception e) { throw new IllegalStateException("Fail to unzip " + zip + " to " + targetDirNormalizedPath, e); } } }
ZipUtils { static void javaUnzip(File zip, File toDir) { Path targetDirNormalizedPath = toDir.toPath().normalize(); try { try (ZipFile zipFile = new ZipFile(zip)) { Enumeration<? extends ZipEntry> entries = zipFile.entries(); while (entries.hasMoreElements()) { ZipEntry entry = entries.nextElement(); File to = targetDirNormalizedPath.resolve(entry.getName()).toFile(); verifyInsideTargetDirectory(entry, to.toPath(), targetDirNormalizedPath); if (entry.isDirectory()) { FileUtils.forceMkdir(to); } else { File parent = to.getParentFile(); if (parent != null) { FileUtils.forceMkdir(parent); } try (OutputStream fos = new BufferedOutputStream(Files.newOutputStream(to.toPath()))) { IOUtils.copy(zipFile.getInputStream(entry), fos); } } } } } catch (Exception e) { throw new IllegalStateException("Fail to unzip " + zip + " to " + targetDirNormalizedPath, e); } } private  ZipUtils(); }
ZipUtils { static void javaUnzip(File zip, File toDir) { Path targetDirNormalizedPath = toDir.toPath().normalize(); try { try (ZipFile zipFile = new ZipFile(zip)) { Enumeration<? extends ZipEntry> entries = zipFile.entries(); while (entries.hasMoreElements()) { ZipEntry entry = entries.nextElement(); File to = targetDirNormalizedPath.resolve(entry.getName()).toFile(); verifyInsideTargetDirectory(entry, to.toPath(), targetDirNormalizedPath); if (entry.isDirectory()) { FileUtils.forceMkdir(to); } else { File parent = to.getParentFile(); if (parent != null) { FileUtils.forceMkdir(parent); } try (OutputStream fos = new BufferedOutputStream(Files.newOutputStream(to.toPath()))) { IOUtils.copy(zipFile.getInputStream(entry), fos); } } } } } catch (Exception e) { throw new IllegalStateException("Fail to unzip " + zip + " to " + targetDirNormalizedPath, e); } } private  ZipUtils(); static void unzip(File zip, File toDir); }
ZipUtils { static void javaUnzip(File zip, File toDir) { Path targetDirNormalizedPath = toDir.toPath().normalize(); try { try (ZipFile zipFile = new ZipFile(zip)) { Enumeration<? extends ZipEntry> entries = zipFile.entries(); while (entries.hasMoreElements()) { ZipEntry entry = entries.nextElement(); File to = targetDirNormalizedPath.resolve(entry.getName()).toFile(); verifyInsideTargetDirectory(entry, to.toPath(), targetDirNormalizedPath); if (entry.isDirectory()) { FileUtils.forceMkdir(to); } else { File parent = to.getParentFile(); if (parent != null) { FileUtils.forceMkdir(parent); } try (OutputStream fos = new BufferedOutputStream(Files.newOutputStream(to.toPath()))) { IOUtils.copy(zipFile.getInputStream(entry), fos); } } } } } catch (Exception e) { throw new IllegalStateException("Fail to unzip " + zip + " to " + targetDirNormalizedPath, e); } } private  ZipUtils(); static void unzip(File zip, File toDir);  }