From f6812f151878c48fc62fb0f40b8926de5a93a7bd Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:04:19 +0000
Subject: [PATCH] Fix java/zipslip CodeQL alerts by validating archive entry paths (#761)

---
 opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
index 0d36598..5e344e8 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
@@ -13,7 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
- * Portions Copyrighted 2026 3A Systems, LLC.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.util;
 
@@ -32,6 +32,7 @@
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.nio.ByteBuffer;
+import java.nio.file.Path;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
@@ -2535,12 +2536,18 @@
   public static void extractZipArchive(File zipFile, File targetDirectory, List<String> executableDirectories,
       List<String> executableFiles) throws IOException
   {
+    Path targetDir = targetDirectory.toPath().toAbsolutePath().normalize();
     try (ZipInputStream zipStream = new ZipInputStream(new FileInputStream(zipFile)))
     {
       ZipEntry fileEntry;
       while ((fileEntry = zipStream.getNextEntry()) != null)
       {
-        File targetFile = new File(targetDirectory.getPath(), fileEntry.getName());
+        Path targetPath = targetDir.resolve(fileEntry.getName()).normalize();
+        if (!targetPath.startsWith(targetDir))
+        {
+          throw new IOException("Zip entry '" + fileEntry.getName() + "' is outside of the target directory");
+        }
+        File targetFile = targetPath.toFile();
 
         if (fileEntry.isDirectory())
         {

--
Gitblit v1.10.0