Fix: normalize multiple slashes when detecting potentially malicious zip files (#1933)

Author: netomi

server/src/main/java/org/eclipse/openvsx/scanning/MaliciousZipCheckService.java

@@ -77,7 +77,7 @@ private PublishCheck.Result checkForDuplicateEntries(ZipFile zipFile) {
             // yauzl which is used by VS Code to extract vsix archives, silently normalizes
             // backslash characters to forward slashes, so we reject any extension that contains
             // duplicate filenames after normalization to avoid any potential issue.
-            var normalizedName = Path.of(name).normalize().toString().replaceAll("\\\\+", "/");
+            var normalizedName = Path.of(name).normalize().toString().replaceAll("\\\\+", "/").replaceAll("/+", "/");
             if (!seen.add(normalizedName)) {
                 return PublishCheck.Result.fail(DUPLICATE_ENTRIES_RULE, DUPLICATE_ENTRIES_MESSAGE);
             }

server/src/test/java/org/eclipse/openvsx/scanning/MaliciousZipCheckServiceTest.java

@@ -130,6 +130,30 @@ void check_failsWhenEntriesCollideAfterDotDotSegmentNormalization() throws Excep
         assertEquals("UNSAFE_PATH_DETECTED", result.failures().getLast().ruleName());
     }
 
+    @Test
+    void check_failsWhenEntriesCollideAfterDotDotSegmentNormalizationMultipleSlashes() throws Exception {
+        TempFile extensionFile = createZipWithEntries("dotdot-segment.vsix",
+            "extension\\/package.json", "extension/package.json");
+
+        var result = service.check(createContext(extensionFile));
+
+        assertFalse(result.passed());
+        assertEquals(1, result.failures().size());
+        assertEquals("DUPLICATE_NORMALIZED_ENTRIES", result.failures().getFirst().ruleName());
+    }
+
+    @Test
+    void check_failsWhenEntriesCollideAfterDotDotSegmentNormalizationMultipleSlashes2() throws Exception {
+        TempFile extensionFile = createZipWithEntries("dotdot-segment.vsix",
+            "extension/\\package.json", "extension/package.json");
+
+        var result = service.check(createContext(extensionFile));
+
+        assertFalse(result.passed());
+        assertEquals(1, result.failures().size());
+        assertEquals("DUPLICATE_NORMALIZED_ENTRIES", result.failures().getFirst().ruleName());
+    }
+
     // --- Unsafe paths checks ---
 
     @Test