Check if unzipped file is in target directory. ACDM-1411 #resolve

FenixEdu · May 30, 2018 · a64a568 · a64a568
1 parent bff0966
commit a64a568
Showing 1 changed file with 11 additions and 13 deletions.
diff --git a/src/main/java/org/fenixedu/academic/util/FileUtils.java b/src/main/java/org/fenixedu/academic/util/FileUtils.java
@@ -22,23 +22,16 @@
  */
 package org.fenixedu.academic.util;
 
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
+import com.google.common.io.ByteStreams;
+import com.google.common.io.Files;
+import org.fenixedu.academic.domain.exceptions.DomainException;
+
+import java.io.*;
 import java.util.UUID;
 import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
-import org.fenixedu.academic.domain.exceptions.DomainException;
-
-import com.google.common.io.ByteStreams;
-import com.google.common.io.Files;
-
 /**
  * @author Luis Cruz
  * @author Shezad Anavarali
@@ -116,6 +109,11 @@ public static File unzipFile(File file) throws IOException {
             while (zipEntry != null) {
                 zipEntry.getName();
                 zipContentFile = new File(tempDir, zipEntry.getName());
+
+                if(!zipContentFile.getCanonicalPath().startsWith(tempDir.getCanonicalPath())) {
+                    throw new IOException("Malformed zip entry " + zipEntry.getName());
+                }
+
                 zipContentFileParentDir = zipContentFile.getParentFile();
                 zipContentFileParentDir.mkdirs();
 
@@ -160,4 +158,4 @@ public static File copyFileToAnotherDirWithRelativePaths(File srcDir, File destD
         }
     }
 
-}
+}