center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

Merge pull request #1729 from dataease/pr@dev@fix_ziputil

Browse Source 
fix: 解压zip未判断子目录
This commit is contained in:
fit2cloud-chenyw 2022-02-05 23:51:19 +08:00 committed by GitHub
commit fc1720c518
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
backend/src/main/java/io/dataease/commons/utils/ZipUtils.java
View File

@ -6,6 +6,8 @@ import java.util.zip.ZipEntry;
import java.util.zip.ZipException; import java.util.zip.ZipException;
import java.util.zip.ZipFile; import java.util.zip.ZipFile;
import java.util.zip.ZipInputStream; import java.util.zip.ZipInputStream;
import java.nio.file.Path;
import java.nio.file.Paths;
public class ZipUtils { public class ZipUtils {
@ -29,7 +31,7 @@ public class ZipUtils {
ZipEntry ze = zis.getNextEntry(); ZipEntry ze = zis.getNextEntry();
while (ze != null) { while (ze != null) {
String fileName = ze.getName(); String fileName = ze.getName();
File newFile = new File(outputFolder + File.separator + fileName); File newFile = protectZipSlip(fileName, outputFolder);
//大部分网络上的源码，这里没有判断子目录 //大部分网络上的源码，这里没有判断子目录
if (ze.isDirectory()) { if (ze.isDirectory()) {
if (!newFile.mkdirs()) { if (!newFile.mkdirs()) {
@ -60,7 +62,7 @@ public class ZipUtils {
while (entry != null) { while (entry != null) {
File file = new File(out, entry.getName()); File file = protectZipSlip(entry.getName(), out);
if (entry.isDirectory()) { if (entry.isDirectory()) {
if (!file.mkdirs()) { if (!file.mkdirs()) {
@ -130,4 +132,17 @@ public class ZipUtils {
} }
} }
public static File protectZipSlip(String fileName, String destDir) throws IOException{
Path destPath = Paths.get(destDir);
Path resolvedDest = destPath.resolve(fileName);
Path normalizedPath = resolvedDest.normalize();
// checking whether zipEntry filename has changed the destination
if (!normalizedPath.startsWith(destDir)) {
throw new IOException("Malicious zip entry found: " + fileName);
}
File newFile = normalizedPath.toFile();
return newFile;
}
} }