Remove unnecessary check for the ..

The check for `startsWith(workDirectory)` in the target file
canonical path is fully enough
This commit is contained in:
Artem Bilan
2018-05-04 15:06:18 -04:00
parent e7964f7175
commit 8d1752cb98

View File

@@ -136,8 +136,7 @@ public class UnZipTransformer extends AbstractZipTransformer {
/* If we see the relative traversal string of ".." we need to make sure
* that the outputdir + name doesn't leave the outputdir.
*/
if (zipEntryName.contains("..") &&
!destinationFile.getCanonicalPath().startsWith(workDirectory.getCanonicalPath())) {
if (!destinationFile.getCanonicalPath().startsWith(workDirectory.getCanonicalPath())) {
throw new ZipException("The file " + zipEntryName +
" is trying to leave the target output directory of " + workDirectory);
}