Skip to content

Commit

Permalink
handle absolute paths correctly when unzipping
Browse files Browse the repository at this point in the history
When checking that an unzipped file does not break out of the target directory - this handles '..' in absolute paths correctly, where the previous implementation might not.
  • Loading branch information
aviadatsnyk committed May 8, 2018
1 parent 7250d8b commit e7cc06e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion core/src/main/java/hudson/FilePath.java
Expand Up @@ -598,7 +598,7 @@ private void unzip(File dir, File zipFile) throws IOException {
while (entries.hasMoreElements()) {
ZipEntry e = entries.nextElement();
File f = new File(dir, e.getName());
if (!f.toPath().normalize().startsWith(dir.toPath())) {
if (!f.getCanonicalPath().startsWith(dir.getCanonicalPath())) {
throw new IOException(
"Zip " + zipFile.getPath() + " contains illegal file name that breaks out of the target directory: " + e.getName());
}
Expand Down

0 comments on commit e7cc06e

Please sign in to comment.