Merge pull request dataease#1713 from ready-research/ready-research-patch-1

fit2cloud-chenyw · web-flow · commit d6f9c33f567e · 2022-02-05T23:41:43.000+08:00
Avoid Zip slip vulnerability
diff --git a/backend/src/main/java/io/dataease/commons/utils/ZipUtils.java b/backend/src/main/java/io/dataease/commons/utils/ZipUtils.java
@@ -6,6 +6,8 @@
 import java.util.zip.ZipException;
 import java.util.zip.ZipFile;
 import java.util.zip.ZipInputStream;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 
 public class ZipUtils {
 
@@ -29,7 +31,7 @@ public static void unZipIt(String zipFilePath, String outputFolder) {
             ZipEntry ze = zis.getNextEntry();
             while (ze != null) {
                 String fileName = ze.getName();
-                File newFile = new File(outputFolder + File.separator + fileName);
+                File newFile = protectZipSlip(fileName, outputFolder);
                 //大部分网络上的源码，这里没有判断子目录
                 if (ze.isDirectory()) {
                     if (!newFile.mkdirs()) {
@@ -60,7 +62,7 @@ public static void unzip(File source, String out) throws IOException {
 
             while (entry != null) {
 
-                File file = new File(out, entry.getName());
+                File file = protectZipSlip(entry.getName(), out);
 
                 if (entry.isDirectory()) {
                     if (!file.mkdirs()) {
@@ -130,4 +132,17 @@ public static void upZipFile(File zipFile, String folderPath) throws ZipExceptio
 
         }
     }
+    public static File protectZipSlip(String fileName, String destDir) throws IOException{
+        Path destPath = Paths.get(destDir);
+        Path resolvedDest = destPath.resolve(fileName);
+        Path normalizedPath = resolvedDest.normalize();
+
+        // checking whether zipEntry filename has changed the destination
+        if (!normalizedPath.startsWith(destDir)) {
+            throw new IOException("Malicious zip entry found: " + fileName);
+        }
+
+        File newFile = normalizedPath.toFile();
+        return newFile;
+    }
 }
