From f6812f151878c48fc62fb0f40b8926de5a93a7bd Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:04:19 +0000
Subject: [PATCH] Fix java/zipslip CodeQL alerts by validating archive entry paths (#761)
---
opendj-server-legacy/src/main/java/org/opends/server/util/BackupManager.java | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/BackupManager.java b/opendj-server-legacy/src/main/java/org/opends/server/util/BackupManager.java
index 591e788..98f3522 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/BackupManager.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/BackupManager.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2009 Sun Microsystems, Inc.
* Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.util;
@@ -1098,7 +1099,11 @@
private void restoreZipEntry(String zipEntryName, ZipInputStream zipStream, Path restoreDir,
RestoreConfig restoreConfig) throws IOException, DirectoryException
{
- Path fileToRestore = restoreDir.resolve(zipEntryName);
+ Path fileToRestore = restoreDir.resolve(zipEntryName).normalize();
+ if (!fileToRestore.startsWith(restoreDir.normalize()))
+ {
+ throw new IOException("Zip entry '" + zipEntryName + "' is outside of the restore directory");
+ }
ensureFileCanBeRestored(fileToRestore);
try (OutputStream outputStream = new FileOutputStream(fileToRestore.toFile()))
--
Gitblit v1.10.0