Skip to content

Commit d3ddada

Browse files
Potential fix for code scanning alert no. 2: Arbitrary file access during archive extraction ("Zip Slip")
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent fab13a0 commit d3ddada

File tree

1 file changed

+5
-2
lines changed
  • OLD/AndroidEmulatorManagerMavenVersion/src/main/java/com/androidemulatormanager

1 file changed

+5
-2
lines changed

OLD/AndroidEmulatorManagerMavenVersion/src/main/java/com/androidemulatormanager/SdkManager.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,8 +177,11 @@ private void extractZip(Path zipPath, Path destPath) throws IOException {
177177
try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipPath.toFile()))) {
178178
ZipEntry entry;
179179
while ((entry = zis.getNextEntry()) != null) {
180-
Path entryPath = destPath.resolve(entry.getName());
181-
180+
Path entryPath = destPath.resolve(entry.getName()).normalize();
181+
// Zip Slip protection: ensure entryPath stays within destPath
182+
if (!entryPath.startsWith(destPath.normalize())) {
183+
throw new IOException("Bad zip entry: " + entry.getName());
184+
}
182185
if (entry.isDirectory()) {
183186
Files.createDirectories(entryPath);
184187
} else {

0 commit comments

Comments
 (0)