From f6812f151878c48fc62fb0f40b8926de5a93a7bd Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:04:19 +0000
Subject: [PATCH] Fix java/zipslip CodeQL alerts by validating archive entry paths (#761)
---
opendj-server-legacy/src/main/java/org/opends/quicksetup/util/ZipExtractor.java | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/quicksetup/util/ZipExtractor.java b/opendj-server-legacy/src/main/java/org/opends/quicksetup/util/ZipExtractor.java
index d351e5a..fe3542d 100644
--- a/opendj-server-legacy/src/main/java/org/opends/quicksetup/util/ZipExtractor.java
+++ b/opendj-server-legacy/src/main/java/org/opends/quicksetup/util/ZipExtractor.java
@@ -13,6 +13,7 @@
*
* Copyright 2007-2008 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.quicksetup.util;
@@ -27,6 +28,7 @@
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
+import java.nio.file.Path;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
@@ -173,6 +175,7 @@
*/
Map<String, List<String>> permissions = new HashMap<>();
permissions.put(getProtectedDirectoryPermissionUnix(), newArrayList(destDir));
+ Path destDirPath = new File(destDir).toPath().toAbsolutePath().normalize();
try {
if(application != null) {
application.checkAbort();
@@ -198,9 +201,13 @@
}
}
if (name != null && name.length() > 0) {
+ Path destination = destDirPath.resolve(name).normalize();
+ if (!destination.startsWith(destDirPath)) {
+ throw new IOException("Zip entry '" + entry.getName()
+ + "' is outside of the destination directory");
+ }
try {
- File destination = new File(destDir, name);
- copyZipEntry(entry, destination, zipIn,
+ copyZipEntry(entry, destination.toFile(), zipIn,
ratioBeforeCompleted, ratioWhenCompleted, permissions);
} catch (IOException ioe) {
throw new ApplicationException(
--
Gitblit v1.10.0