Merge pull request #3250 from mybatis/autofix/alert-7-b48d877adc

Fix code scanning alert no. 7: Arbitrary file access during archive extraction ("Zip Slip")
mybatis · Sep 26, 2024 · 45953df · 45953df
2 parents 7194767 + ec07133
commit 45953df
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/main/java/org/apache/ibatis/io/DefaultVFS.java b/src/main/java/org/apache/ibatis/io/DefaultVFS.java
@@ -79,10 +79,15 @@ public List<String> list(URL url, String path) throws IOException {
               if (log.isDebugEnabled()) {
                 log.debug("Listing " + url);
               }
+              File destinationDir = new File(path);
               for (JarEntry entry; (entry = jarInput.getNextJarEntry()) != null;) {
                 if (log.isDebugEnabled()) {
                   log.debug("Jar entry: " + entry.getName());
                 }
+                File entryFile = new File(destinationDir, entry.getName()).getCanonicalFile();
+                if (!entryFile.getPath().startsWith(destinationDir.getCanonicalPath())) {
+                  throw new IOException("Bad zip entry: " + entry.getName());
+                }
                 children.add(entry.getName());
               }
             }