diff --git a/src/main/java/org/zeroturnaround/zip/ZipUtil.java b/src/main/java/org/zeroturnaround/zip/ZipUtil.java
index 111ac85..3fda627 100644
--- a/src/main/java/org/zeroturnaround/zip/ZipUtil.java
+++ b/src/main/java/org/zeroturnaround/zip/ZipUtil.java
@@ -1140,7 +1140,7 @@ private static File checkDestinationFileForTraversal(File outputDir, String name
      * that the outputdir + name doesn't leave the outputdir. See
      * DirectoryTraversalMaliciousTest for details.
      */
-    if (name.indexOf("..") != -1 && !destFile.getCanonicalPath().startsWith(outputDir.getCanonicalPath())) {
+    if (name.indexOf("..") != -1 && !destFile.getCanonicalFile().toPath().startsWith(outputDir.getCanonicalFile().toPath())) {
       throw new MaliciousZipException(outputDir, name);
     }
     return destFile;
diff --git a/src/test/java/example/UnpackExample.java b/src/test/java/example/UnpackExample.java
index 32ed58a..3fae49e 100644
--- a/src/test/java/example/UnpackExample.java
+++ b/src/test/java/example/UnpackExample.java
@@ -26,7 +26,11 @@ public static void usual() throws IOException {
         OutputStream out = null; 
         try {
           in = zf.getInputStream(e);
-          out = new FileOutputStream(new File("demo", e.getName()));
+          final File zipEntryFile = new File("demo", e.getName());
+          if (!zipEntryFile.toPath().normalize().startsWith("demo")) {
+            throw new IOException("Bad zip entry");
+          }
+          out = new FileOutputStream(zipEntryFile);
           IOUtils.copy(in, out);
         }
         finally {