Mitigating ZipSlip vulnerability (#6630)

* patched org/nd4j/util/ArchiveUtils.java to mitigate ZipSlip vulnerability * log nitpick
deeplearning4j · Oct 24, 2018 · f51f424 · f51f424
1 parent 72ce4be
commit f51f424
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/nd4j/nd4j-common/src/main/java/org/nd4j/util/ArchiveUtils.java b/nd4j/nd4j-common/src/main/java/org/nd4j/util/ArchiveUtils.java
@@ -65,7 +65,15 @@ public static void unzipFileTo(String file, String dest) throws IOException {
 
                 while (ze != null) {
                     String fileName = ze.getName();
+
+                    String canonicalDestinationDirPath = new File(dest).getCanonicalPath();
                     File newFile = new File(dest + File.separator + fileName);
+                    String canonicalDestinationFile = newFile.getCanonicalPath();
+
+                    if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator)) {
+                        log.debug("Attempt to unzip entry is outside of the target dir");
+                        throw new IOException("Entry is outside of the target dir: ");
+                    }
 
                     if (ze.isDirectory()) {
                         newFile.mkdirs();