From f6812f151878c48fc62fb0f40b8926de5a93a7bd Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:04:19 +0000
Subject: [PATCH] Fix java/zipslip CodeQL alerts by validating archive entry paths (#761)
---
opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
index 0d36598..5e344e8 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/StaticUtils.java
@@ -13,7 +13,7 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
- * Portions Copyrighted 2026 3A Systems, LLC.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.util;
@@ -32,6 +32,7 @@
import java.net.ServerSocket;
import java.net.Socket;
import java.nio.ByteBuffer;
+import java.nio.file.Path;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
@@ -2535,12 +2536,18 @@
public static void extractZipArchive(File zipFile, File targetDirectory, List<String> executableDirectories,
List<String> executableFiles) throws IOException
{
+ Path targetDir = targetDirectory.toPath().toAbsolutePath().normalize();
try (ZipInputStream zipStream = new ZipInputStream(new FileInputStream(zipFile)))
{
ZipEntry fileEntry;
while ((fileEntry = zipStream.getNextEntry()) != null)
{
- File targetFile = new File(targetDirectory.getPath(), fileEntry.getName());
+ Path targetPath = targetDir.resolve(fileEntry.getName()).normalize();
+ if (!targetPath.startsWith(targetDir))
+ {
+ throw new IOException("Zip entry '" + fileEntry.getName() + "' is outside of the target directory");
+ }
+ File targetFile = targetPath.toFile();
if (fileEntry.isDirectory())
{
--
Gitblit v1.10.0