Fix zipslip for jar

Vineflower · Dec 17, 2024 · 880306e · 880306e
1 parent ddf8471
commit 880306e
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 1 deletion.
diff --git a/src/org/jetbrains/java/decompiler/struct/ContextUnit.java b/src/org/jetbrains/java/decompiler/struct/ContextUnit.java
@@ -10,9 +10,11 @@
 import org.jetbrains.java.decompiler.main.extern.IResultSaver;
 import org.jetbrains.java.decompiler.util.TextBuffer;
 
+import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.FileSystems;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -131,12 +133,14 @@ public void save(final Function<String, StructClass> loader) throws IOException
 
     // directory entries
     for (String dirEntry : dirEntries) {
+      if (dirEntry.contains("..")) { continue; }
       sink.acceptDirectory(dirEntry);
     }
 
     // non-class entries
     for (IContextSource.Entry otherEntry : otherEntries) {
-      sink.acceptOther(otherEntry.path());
+      String cleanedPath =  FileSystems.getDefault().getPath("/"+otherEntry.path()).normalize().toString();
+      sink.acceptOther(cleanedPath.substring(1)); // remove initial / needed for normalize to work
     }
 
     //Whooo threads!

diff --git a/test/org/jetbrains/java/decompiler/CommandLineTest.java b/test/org/jetbrains/java/decompiler/CommandLineTest.java
@@ -6,9 +6,14 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import java.io.File;
+import java.io.FileOutputStream;
 import java.io.IOException;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
 
 import static org.jetbrains.java.decompiler.DecompilerTestFixture.assertFilesEqual;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 
 public class CommandLineTest {
   private DecompilerTestFixture fixture;
@@ -48,6 +53,30 @@ public void testJarToDir() {
     assertFilesEqual(fixture.getTestDataDir().resolve("bulk"), fixture.getTempDir().resolve("bulk_out"));
   }
 
+  @Test
+  public void testMaliciousJarToDir() throws IOException {
+    String out = fixture.getTempDir().resolve("bulk_out").toAbsolutePath().toString();
+    String in = fixture.getTestDataDir().resolve("mal.jar").toAbsolutePath().toString();
+    // create malicious jar if doesn't exist already
+    if (!new File(in).exists())
+    {
+      String badFileName = new String("../../../../../../../../../../../tmp/test.txt");
+      try (ZipOutputStream maliciousOut = new ZipOutputStream(new FileOutputStream(fixture.getTestDataDir().resolve("mal.jar").toAbsolutePath().toString())))
+      {
+          ZipEntry entry = new ZipEntry(badFileName);
+          maliciousOut.putNextEntry(entry);
+          maliciousOut.write("womp womp".getBytes());
+          maliciousOut.closeEntry();
+      }
+    }
+
+    ConsoleDecompiler.main(new String[]{in, out});
+
+    TextBuffer.checkLeaks();
+    File f = new File("/tmp/test.txt");
+    assertFalse(f.exists());  
+}
+
   @Test
   public void testZipToJar() {
     String out = fixture.getTempDir().resolve("bulk_out.jar").toAbsolutePath().toString();