Bug 535824 - Check for directory traversal entry pathsY20180712-0200I20180717-0320I20180716-2000I20180716-0715I20180715-2000I20180714-1500I20180713-2000I20180712-2000I20180711-2000I20180710-2000

Change-Id: I105a488ea8264c1a2420a819255e6a95219365ad
Signed-off-by: Thomas Watson <tjwatson@us.ibm.com>

1 files changed, 11 insertions, 1 deletions

diff --git a/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java b/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
index 0b41efe81..92879e84b 100644
--- a/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
+++ b/bundles/org.eclipse.equinox.p2.jarprocessor/src/org/eclipse/equinox/internal/p2/jarprocessor/ZipProcessor.java
@@ -83,7 +83,7 @@ public class ZipProcessor {
 						File extractedFile = null;
 
 						if (entry.getName().endsWith(extension) && (pack || sign || repack || options.unpack)) {
-							extractedFile = new File(tempDir, name);
+							extractedFile = createSubPathFile(tempDir, name);
 							parent = extractedFile.getParentFile();
 							if (!parent.exists())
 								parent.mkdirs();
@@ -192,6 +192,16 @@ public class ZipProcessor {
 
 	}
 
+	public static File createSubPathFile(File root, String subPath) throws IOException {
+		File result = new File(root, subPath);
+		String resultCanonical = result.getCanonicalPath();
+		String rootCanonical = root.getCanonicalPath();
+		if (!resultCanonical.startsWith(rootCanonical + File.separator) && !resultCanonical.equals(rootCanonical)) {
+			throw new IOException("Invalid path: " + subPath); //$NON-NLS-1$
+		}
+		return result;
+	}
+
 	private void initialize(ZipFile zip) {
 		ZipEntry entry = zip.getEntry("pack.properties"); //$NON-NLS-1$
 		properties = new Properties();