[#514] fix CVE on JarScanner

highsource · Mar 4, 2024 · 4a3fc57 · 4a3fc57
1 parent 923215e
commit 4a3fc57
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/maven-plugin/plugin-core/src/main/java/org/jvnet/jaxb/maven/util/JarScanner.java b/maven-plugin/plugin-core/src/main/java/org/jvnet/jaxb/maven/util/JarScanner.java
@@ -52,6 +52,10 @@ public void scan() {
             while (jarFileEntries.hasMoreElements()) {
                 JarEntry entry = jarFileEntries.nextElement();
                 String name = entry.getName();
+                if (name.startsWith("..") || name.startsWith("/")) {
+                    // ignore "zip slip" file pattern attack
+                    continue;
+                }
                 char[][] tokenizedName = tokenizePathToCharArray(name, File.separator);
                 if (name.endsWith("/")) {
                     // entry is a directory -> skip