diff --git a/engine/src/main/java/org/n52/javaps/engine/impl/FileBasedResultPersistence.java b/engine/src/main/java/org/n52/javaps/engine/impl/FileBasedResultPersistence.java index 438f0e11..ba136b63 100644 --- a/engine/src/main/java/org/n52/javaps/engine/impl/FileBasedResultPersistence.java +++ b/engine/src/main/java/org/n52/javaps/engine/impl/FileBasedResultPersistence.java @@ -300,8 +300,10 @@ private void persist(Path directory, Encoder base64encoder = Base64.getEncoder(); - OutputStream outputStream = base64encoder.wrap(new FileOutputStream(outputFile.toFile())); - IOUtils.copy(in, outputStream); + try (OutputStream outputStream = base64encoder.wrap(new FileOutputStream(outputFile + .toFile()))) { + IOUtils.copy(in, outputStream); + } } } else { diff --git a/engine/src/main/java/org/n52/javaps/utils/IOUtils.java b/engine/src/main/java/org/n52/javaps/utils/IOUtils.java index 00bde383..8a237f4b 100644 --- a/engine/src/main/java/org/n52/javaps/utils/IOUtils.java +++ b/engine/src/main/java/org/n52/javaps/utils/IOUtils.java @@ -179,6 +179,9 @@ public static List unzipAll(File file) throws IOException { try (ZipInputStream zipInputStream = new ZipInputStream(new BufferedInputStream(new FileInputStream(file)))) { while ((entry = zipInputStream.getNextEntry()) != null) { entryFile = new File(tempDir, entry.getName()); + if (!file.toPath().normalize().startsWith(tempDir.toPath())) { + throw new IOException("Bad zip entry: " + entry.getName()); + } boolean created = entryFile.createNewFile(); if (!created) { LOGGER.info("File already exists: " + entryFile.getAbsolutePath()); diff --git a/webapp/src/main/webapp/static/index.html b/webapp/src/main/webapp/static/index.html index a6fee71e..8e0dc4cb 100644 --- a/webapp/src/main/webapp/static/index.html +++ b/webapp/src/main/webapp/static/index.html @@ -40,11 +40,10 @@

Test requests

-