Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.3.x' into 2.4.x

Browse Source 
Closes gh-25508
This commit is contained in:
Andy Wilkinson
2021-03-05 10:38:36 +00:00
parent 2682b3803a 1ac9b3fac2
commit ac258a95a2
2 changed files with 40 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
spring-boot-project/spring-boot-tools/spring-boot-jarmode-layertools/src/main/java/org/springframework/boot/jarmode/layertools/ExtractCommand.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2020 the original author or authors.
* Copyright 2012-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -29,7 +29,6 @@ import java.util.zip.ZipInputStream;
import org.springframework.util.Assert;
import org.springframework.util.StreamUtils;
import org.springframework.util.StringUtils;
/**
* The {@code 'extract'} tools command.
@@ -86,15 +85,18 @@ class ExtractCommand extends Command {
}
private void write(ZipInputStream zip, ZipEntry entry, File destination) throws IOException {
String path = StringUtils.cleanPath(entry.getName());
File file = new File(destination, path);
if (file.getAbsolutePath().startsWith(destination.getAbsolutePath())) {
mkParentDirs(file);
try (OutputStream out = new FileOutputStream(file)) {
StreamUtils.copy(zip, out);
}
Files.setAttribute(file.toPath(), "creationTime", entry.getCreationTime());
String canonicalOutputPath = destination.getCanonicalPath() + File.separator;
File file = new File(destination, entry.getName());
String canonicalEntryPath = file.getCanonicalPath();
Assert.state(canonicalEntryPath.startsWith(canonicalOutputPath),
() -> "Entry '" + entry.getName() + "' would be written to '" + canonicalEntryPath
+ "'. This is outside the output location of '" + canonicalOutputPath
+ "'. Verify the contents of your archive.");
mkParentDirs(file);
try (OutputStream out = new FileOutputStream(file)) {
StreamUtils.copy(zip, out);
}
Files.setAttribute(file.toPath(), "creationTime", entry.getCreationTime());
}
private void mkParentDirs(File file) throws IOException {