Skip to main content
aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat (limited to 'bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java')
-rw-r--r--bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java12
1 files changed, 11 insertions, 1 deletions
diff --git a/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java b/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
index 0b41efe81..92879e84b 100644
--- a/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
+++ b/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
@@ -83,7 +83,7 @@ public class ZipProcessor {
File extractedFile = null;
if (entry.getName().endsWith(extension) && (pack || sign || repack || options.unpack)) {
- extractedFile = new File(tempDir, name);
+ extractedFile = createSubPathFile(tempDir, name);
parent = extractedFile.getParentFile();
if (!parent.exists())
parent.mkdirs();
@@ -192,6 +192,16 @@ public class ZipProcessor {
}
+ public static File createSubPathFile(File root, String subPath) throws IOException {
+ File result = new File(root, subPath);
+ String resultCanonical = result.getCanonicalPath();
+ String rootCanonical = root.getCanonicalPath();
+ if (!resultCanonical.startsWith(rootCanonical + File.separator) && !resultCanonical.equals(rootCanonical)) {
+ throw new IOException("Invalid path: " + subPath); //$NON-NLS-1$
+ }
+ return result;
+ }
+
private void initialize(ZipFile zip) {
ZipEntry entry = zip.getEntry("pack.properties"); //$NON-NLS-1$
properties = new Properties();

Back to the top