Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.4.x'

Browse Source 
Closes gh-25509
This commit is contained in:
Andy Wilkinson
2021-03-05 10:44:24 +00:00
parent 76d0a7f8ba ac258a95a2
commit 2b7f23b29d
2 changed files with 38 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
spring-boot-project/spring-boot-tools/spring-boot-jarmode-layertools/src/main/java/org/springframework/boot/jarmode/layertools/ExtractCommand.java
View File

@@ -29,7 +29,6 @@ import java.util.zip.ZipInputStream;
import org.springframework.util.Assert;
import org.springframework.util.StreamUtils;
import org.springframework.util.StringUtils;
/**
* The {@code 'extract'} tools command.
@@ -86,15 +85,18 @@ class ExtractCommand extends Command {
}
private void write(ZipInputStream zip, ZipEntry entry, File destination) throws IOException {
String path = StringUtils.cleanPath(entry.getName());
File file = new File(destination, path);
if (file.getAbsolutePath().startsWith(destination.getAbsolutePath())) {
mkParentDirs(file);
try (OutputStream out = new FileOutputStream(file)) {
StreamUtils.copy(zip, out);
}
Files.setAttribute(file.toPath(), "creationTime", entry.getCreationTime());
String canonicalOutputPath = destination.getCanonicalPath() + File.separator;
File file = new File(destination, entry.getName());
String canonicalEntryPath = file.getCanonicalPath();
Assert.state(canonicalEntryPath.startsWith(canonicalOutputPath),
() -> "Entry '" + entry.getName() + "' would be written to '" + canonicalEntryPath
+ "'. This is outside the output location of '" + canonicalOutputPath
+ "'. Verify the contents of your archive.");
mkParentDirs(file);
try (OutputStream out = new FileOutputStream(file)) {
StreamUtils.copy(zip, out);
}
Files.setAttribute(file.toPath(), "creationTime", entry.getCreationTime());
}
private void mkParentDirs(File file) throws IOException {