ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2024-12-20 05:28:21 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merged in fix-zip-path (pull request #191)

Browse Source 
Fix up bug in attachment Zip file processing when path might not be normalised to start with
This commit is contained in:
Rick Parker 2016-06-29 09:26:33 +01:00
commit 549a72bf77
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/src/main/kotlin/com/r3corda/core/Utils.kt
View File

@ -11,7 +11,6 @@ import java.io.InputStream
import java.math.BigDecimal import java.math.BigDecimal
import java.nio.file.Files import java.nio.file.Files
import java.nio.file.Path import java.nio.file.Path
import java.security.SecureRandom
import java.time.Duration import java.time.Duration
import java.time.temporal.Temporal import java.time.temporal.Temporal
import java.util.concurrent.Executor import java.util.concurrent.Executor
@ -177,16 +176,17 @@ class TransientProperty<T>(private val initializer: () -> T) {
* Given a path to a zip file, extracts it to the given directory. * Given a path to a zip file, extracts it to the given directory.
*/ */
fun extractZipFile(zipPath: Path, toPath: Path) { fun extractZipFile(zipPath: Path, toPath: Path) {
if (!Files.exists(toPath)) val normalisedToPath = toPath.normalize()
Files.createDirectories(toPath) if (!Files.exists(normalisedToPath))
Files.createDirectories(normalisedToPath)
ZipInputStream(BufferedInputStream(Files.newInputStream(zipPath))).use { zip -> ZipInputStream(BufferedInputStream(Files.newInputStream(zipPath))).use { zip ->
while (true) { while (true) {
val e = zip.nextEntry ?: break val e = zip.nextEntry ?: break
val outPath = toPath.resolve(e.name) val outPath = normalisedToPath.resolve(e.name)
// Security checks: we should reject a zip that contains tricksy paths that try to escape toPath. // Security checks: we should reject a zip that contains tricksy paths that try to escape toPath.
if (!outPath.normalize().startsWith(toPath)) if (!outPath.normalize().startsWith(normalisedToPath))
throw IllegalStateException("ZIP contained a path that resolved incorrectly: ${e.name}") throw IllegalStateException("ZIP contained a path that resolved incorrectly: ${e.name}")
if (e.isDirectory) { if (e.isDirectory) {