address path traversal vulnerability
Summary: Address vulnerability task as per the suggested fix. Also address a bug in the previously reverted diff (https://github.com/facebookincubator/profilo/commit/62b922a1a4c7530c2dc9b4e6a34d48cb20b8f355), by comparing canonical path substrings instead of the directory name.
@@ -15,7 +15,6 @@ import java.util.zip.ZipInputStream;
import java.util.zip.ZipOutputStream;
public class ZipHelper {
-
public static final String ZIP_SUFFIX = ".zip";
public static final String TMP_SUFFIX = ".tmp";
@@ -135,6 +134,9 @@ public class ZipHelper {
while (entry != null) {
File newFile = new File(extractDir, entry.getName());
+ if (!newFile.getCanonicalPath().startsWith(extractDir.getCanonicalPath())) {
+ throw new IOException("Invalid entry name. Possible path traversal.");
+ }
if (entry.isDirectory()) {
if (!newFile.isDirectory() && !newFile.mkdirs()) {
throw new IOException("Can't create directory");
