From 8d1752cb98f40abe521cc35884efe68c577b64eb Mon Sep 17 00:00:00 2001 From: Artem Bilan Date: Fri, 4 May 2018 15:06:18 -0400 Subject: [PATCH] Remove unnecessary check for the `..` The check for `startsWith(workDirectory)` in the target file canonical path is fully enough --- .../integration/zip/transformer/UnZipTransformer.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/spring-integration-zip/src/main/java/org/springframework/integration/zip/transformer/UnZipTransformer.java b/spring-integration-zip/src/main/java/org/springframework/integration/zip/transformer/UnZipTransformer.java index aad8cd4..b9baf0e 100644 --- a/spring-integration-zip/src/main/java/org/springframework/integration/zip/transformer/UnZipTransformer.java +++ b/spring-integration-zip/src/main/java/org/springframework/integration/zip/transformer/UnZipTransformer.java @@ -136,8 +136,7 @@ public class UnZipTransformer extends AbstractZipTransformer { /* If we see the relative traversal string of ".." we need to make sure * that the outputdir + name doesn't leave the outputdir. */ - if (zipEntryName.contains("..") && - !destinationFile.getCanonicalPath().startsWith(workDirectory.getCanonicalPath())) { + if (!destinationFile.getCanonicalPath().startsWith(workDirectory.getCanonicalPath())) { throw new ZipException("The file " + zipEntryName + " is trying to leave the target output directory of " + workDirectory); }