[SECURITY] Fix Zip Slip Vulnerability

pallas-console/src/main/java/com/vip/pallas/cerebro/launcer/CerebroEmbed.java

@@ -1,20 +1,20 @@
-/**
- * Copyright 2019 vip.com.
- * <p>
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * </p>
- */
-
+/**
+ * Copyright 2019 vip.com.
+ * <p>
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * </p>
+ */
+
 package com.vip.pallas.cerebro.launcer;
 
 import java.io.BufferedInputStream;
@@ -59,47 +59,50 @@ private static boolean deleteDir(File dir) {
 		return dir.delete();
 	}
 
-	public static void unzip(File zip, File directory) throws ZipException, IOException {
-		try (ZipFile zipFile = new ZipFile(zip)){
-			Enumeration<? extends ZipEntry> entries = zipFile.entries();
-			while (entries.hasMoreElements()) {
-				ZipEntry zipEntry = entries.nextElement();
-				if (zipEntry.isDirectory()) {
-					File temp = new File(directory + File.separator + zipEntry.getName());
-					temp.mkdirs();
-					continue;
-				}
-				unzip(directory,zipFile, zipEntry);
-			}
+	public static void unzip(File zip, File directory) throws ZipException, IOException {
+		try (ZipFile zipFile = new ZipFile(zip)){
+			Enumeration<? extends ZipEntry> entries = zipFile.entries();
+			while (entries.hasMoreElements()) {
+				ZipEntry zipEntry = entries.nextElement();
+				if (zipEntry.isDirectory()) {
+					File temp = new File(directory + File.separator + zipEntry.getName());
+					temp.mkdirs();
+					continue;
+				}
+				unzip(directory,zipFile, zipEntry);
+			}
+		}
+	}
+
+	private static void unzip(File directory, ZipFile zipFile, ZipEntry zipEntry) throws ZipException, IOException {
+		BufferedInputStream bis = null;
+		BufferedOutputStream bos = null;
+		try {
+			bis = new BufferedInputStream(zipFile.getInputStream(zipEntry));
+			File f = new File(directory, zipEntry.getName());
+    if (!f.toPath().normalize().startsWith(directory.toPath().normalize())) {
+      throw new IOException("Bad zip entry");
+    }
+			File f_p = f.getParentFile();
+			if (f_p != null && !f_p.exists()) {
+				f_p.mkdirs();
+			}
+			bos = new BufferedOutputStream(new FileOutputStream(f));
+			int len = -1;
+			byte[] bs = new byte[2048];
+			while ((len = bis.read(bs, 0, 2048)) != -1) {
+				bos.write(bs, 0, len);
+			}
+		} finally {
+			if (bos != null) {
+				bos.flush();
+				bos.close();
+			}
+			if (bis != null) {
+				bis.close();
+			}
 		}
-	}
-
-	private static void unzip(File directory, ZipFile zipFile, ZipEntry zipEntry) throws ZipException, IOException {
-		BufferedInputStream bis = null;
-		BufferedOutputStream bos = null;
-		try {
-			bis = new BufferedInputStream(zipFile.getInputStream(zipEntry));
-			File f = new File(directory + File.separator + zipEntry.getName());
-			File f_p = f.getParentFile();
-			if (f_p != null && !f_p.exists()) {
-				f_p.mkdirs();
-			}
-			bos = new BufferedOutputStream(new FileOutputStream(f));
-			int len = -1;
-			byte[] bs = new byte[2048];
-			while ((len = bis.read(bs, 0, 2048)) != -1) {
-				bos.write(bs, 0, len);
-			}
-		} finally {
-			if (bos != null) {
-				bos.flush();
-				bos.close();
-			}
-			if (bis != null) {
-				bis.close();
-			}
-		}
-	}
+	}
 
 	public static void launch() throws PallasException, IOException {
 		InputStream is = CerebroEmbed.class.getClassLoader().getResourceAsStream("cerebro.zip");
@@ -137,4 +140,4 @@ public static void launch() throws PallasException, IOException {
 			logger.error("{} not readable, cerebro can not be started! ", zipFile.getAbsolutePath());
 		}
 	}
-}
+}