Add security fix for unzip process

README.md

@@ -45,7 +45,7 @@ repositories {
 }
 
 ext {
-    rlibVersion = "10.0.alpha11"
+    rlibVersion = "10.0.alpha12"
 }
 
 dependencies {

build.gradle

@@ -1,4 +1,4 @@
-rootProject.version = "10.0.alpha11"
+rootProject.version = "10.0.alpha12"
 group = 'javasabr.rlib'
 
 allprojects {

rlib-io/src/main/java/javasabr/rlib/io/util/FileUtils.java

@@ -400,36 +400,35 @@ public static String getFirstFreeName(Path directory, Path file) {
    *
    * @param destination the destination folder.
    * @param zipFile the zip file.
+   * 
+   * @return the count of unpacked files
    */
-  public static void unzip(Path destination, Path zipFile) {
-
+  public static int unzip(Path destination, Path zipFile) {
     if (!Files.exists(destination)) {
       throw new IllegalArgumentException("The folder " + destination + " doesn't exist.");
     }
-
+    int count = 0;
     try (var zin = new ZipInputStream(Files.newInputStream(zipFile))) {
       for (var entry = zin.getNextEntry(); entry != null; entry = zin.getNextEntry()) {
-
         String entryName = entry.getName();
         Path targetFile = destination
             .resolve(entryName)
-            .toRealPath(LinkOption.NOFOLLOW_LINKS);
-
+            .normalize();
         if (!targetFile.startsWith(destination)) {
           LOGGER.warning(entryName, "Unexpected entry name:[%s] which is outside"::formatted);
           continue;
         }
-
         if (entry.isDirectory()) {
           Files.createDirectories(targetFile);
         } else {
           Files.copy(zin, targetFile, StandardCopyOption.REPLACE_EXISTING);
+          count++;
         }
       }
-
     } catch (IOException e) {
       throw new UncheckedIOException(e);
     }
+    return count;
   }
 
   /**

rlib-io/src/test/java/javasabr/rlib/io/FileUtilsTest.java

@@ -2,7 +2,15 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
 import javasabr.rlib.io.util.FileUtils;
+import org.assertj.core.api.Assertions;
 import org.junit.jupiter.api.Test;
 
 /**
@@ -74,4 +82,41 @@ void shouldCheckExistingExtension() {
     assertThat(FileUtils.hasExtension(path6)).isFalse();
     assertThat(FileUtils.hasExtension(path7)).isFalse();
   }
+
+  @Test
+  void shouldUnzipFileCorrectly() throws IOException {
+    // given:
+    Path zipFile = Files.createTempFile("test-archive", ".zip");
+
+    try (var zout = new ZipOutputStream(Files.newOutputStream(zipFile, StandardOpenOption.CREATE))) {
+      zout.putNextEntry(new ZipEntry("fileA.txt"));
+      zout.write("test text".getBytes(StandardCharsets.UTF_8));
+
+      zout.putNextEntry(new ZipEntry("../fileB.txt"));
+      zout.write("test text 2".getBytes(StandardCharsets.UTF_8));
+
+      ZipEntry dirAEntry = new ZipEntry("dir_a/");
+      dirAEntry.setMethod(ZipEntry.STORED);
+      dirAEntry.setSize(0);
+      dirAEntry.setCrc(0);
+      zout.putNextEntry(dirAEntry);
+
+      zout.putNextEntry(new ZipEntry("dir_a/fileC.txt"));
+      zout.write("test text 3".getBytes(StandardCharsets.UTF_8));
+
+      zout.putNextEntry(new ZipEntry("dir_a/../fileD.txt"));
+      zout.write("test text 4".getBytes(StandardCharsets.UTF_8));
+
+      zout.putNextEntry(new ZipEntry("dir_a/../../../fileE.txt"));
+      zout.write("test text 5".getBytes(StandardCharsets.UTF_8));
+    }
+
+    Path outputDir = Files.createTempDirectory("test-unzip");
+
+    // when:
+    int unpackedFiles = FileUtils.unzip(outputDir, zipFile);
+
+    // then:
+    assertThat(unpackedFiles).isEqualTo(3);
+  }
 }