File tree Expand file tree Collapse file tree 1 file changed +13
-3
lines changed
framework/codemodder-base/src/main/java/io/codemodder/remediation/zipslip Expand file tree Collapse file tree 1 file changed +13
-3
lines changed Original file line number Diff line number Diff line change 1010import com .github .javaparser .ast .expr .MethodCallExpr ;
1111import io .codemodder .remediation .RemediationStrategy ;
1212import io .codemodder .remediation .SuccessOrReason ;
13+
14+ import java .lang .invoke .MethodHandleInfo ;
1315import java .util .Optional ;
1416
1517/** Fixes ZipSlip vulnerabilities where a ZipEntry starts the data flow. */
@@ -70,8 +72,16 @@ String sanitizeZipFilename(String entryName) {
7072
7173 /** Return true if it appears to be a ZipEntry#getName() call. */
7274 static boolean match (final Node node ) {
73- return node instanceof MethodCallExpr call
74- && call .getScope ().isPresent ()
75- && "getName" .equals (call .getNameAsString ());
75+ return
76+ Optional .of (node )
77+ .map (n -> n instanceof MethodCallExpr mce ? mce : null )
78+ .filter (mce -> mce .hasScope ())
79+ .filter (mce -> "getName" .equals (mce .getNameAsString ()))
80+ // Not already sanitized
81+ .filter (mce -> mce .getParentNode ()
82+ .map (p -> p instanceof MethodCallExpr m ? m : null )
83+ .filter (m -> "sanitizeZipFilename" .equals (m .getNameAsString ()))
84+ .isEmpty ())
85+ .isPresent ();
7686 }
7787}
You can’t perform that action at this time.
0 commit comments