@@ -642,43 +642,29 @@ private static void decompress7z(File archive, String directory) throws IOExcept
642642 }
643643 }
644644
645- private static boolean isPathTraversal (String dir , String fName ) {
646- try {
647- Path path = Paths .get (dir ).resolve (fName );
648- return !path .toAbsolutePath ().equals (path .toRealPath ());
649- }catch (Exception e ){
650- return true ;
651- }
652- }
653645
654646 private static void decompressTar (File archive , String directory ) throws IOException {
655647 byte [] buffer = new byte [BUFFER_SIZE ];
656648 try (TarArchiveInputStream tis = new TarArchiveInputStream (Files .newInputStream (archive .toPath ()))) {
657649 TarArchiveEntry entry ;
658650 while ((entry = tis .getNextEntry ()) != null ) {
659- if (isPathTraversal (directory , entry .getName ()))
660- {
661- log .error (DIRECTORY_ATTACK + "{}" , entry .getName ());
662- return ;
663- }else {
664- File newFile = new File (directory , entry .getName ());
665- if (HasZipSlipVulnerability (newFile , directory )) {
666- throw new IOException ("Bad tar entry: " + entry .getName ());
651+ File newFile = new File (directory , entry .getName ());
652+ if (HasZipSlipVulnerability (newFile , directory )) {
653+ throw new IOException ("Bad tar entry: " + entry .getName ());
654+ }
655+ if (entry .isDirectory ()) {
656+ if (!newFile .isDirectory () && !newFile .mkdirs ()) {
657+ throw new IOException ("Failed to create directory " + newFile );
667658 }
668- if (entry .isDirectory ()) {
669- if (!newFile .isDirectory () && !newFile .mkdirs ()) {
670- throw new IOException ("Failed to create directory " + newFile );
671- }
672- } else {
673- File parent = newFile .getParentFile ();
674- if (!parent .isDirectory () && !parent .mkdirs ()) {
675- throw new IOException ("Failed to create directory " + parent );
676- }
677- try (OutputStream out = Files .newOutputStream (newFile .toPath ())) {
678- int len ;
679- while ((len = tis .read (buffer )) != -1 ) {
680- out .write (buffer , 0 , len );
681- }
659+ } else {
660+ File parent = newFile .getParentFile ();
661+ if (!parent .isDirectory () && !parent .mkdirs ()) {
662+ throw new IOException ("Failed to create directory " + parent );
663+ }
664+ try (OutputStream out = Files .newOutputStream (newFile .toPath ())) {
665+ int len ;
666+ while ((len = tis .read (buffer )) != -1 ) {
667+ out .write (buffer , 0 , len );
682668 }
683669 }
684670 }
0 commit comments