|
26 | 26 | import java.io.PrintStream; |
27 | 27 | import java.io.UncheckedIOException; |
28 | 28 | import java.nio.file.Files; |
| 29 | +import java.nio.file.Path; |
29 | 30 | import java.nio.file.attribute.BasicFileAttributeView; |
30 | 31 | import java.nio.file.attribute.BasicFileAttributes; |
31 | 32 | import java.nio.file.attribute.FileTime; |
|
55 | 56 | * The {@code 'extract'} tools command. |
56 | 57 | * |
57 | 58 | * @author Moritz Halbritter |
| 59 | + * @author Dongliang Xie |
58 | 60 | */ |
59 | 61 | class ExtractCommand extends Command { |
60 | 62 |
|
@@ -363,14 +365,18 @@ private static void withJarEntries(File file, ManfiestWriter manfiestWriter, Thr |
363 | 365 | } |
364 | 366 |
|
365 | 367 | private static File assertFileIsContainedInDirectory(File directory, File file, String name) throws IOException { |
366 | | - String canonicalOutputPath = directory.getCanonicalPath() + File.separator; |
367 | | - String canonicalEntryPath = file.getCanonicalPath(); |
368 | | - Assert.state(canonicalEntryPath.startsWith(canonicalOutputPath), |
| 368 | + Path canonicalOutputPath = directory.getCanonicalFile().toPath(); |
| 369 | + Path canonicalEntryPath = file.getCanonicalFile().toPath(); |
| 370 | + Assert.state(isFileContainedInDirectory(canonicalOutputPath, canonicalEntryPath), |
369 | 371 | () -> "Entry '%s' would be written to '%s'. This is outside the output location of '%s'. Verify the contents of your archive." |
370 | 372 | .formatted(name, canonicalEntryPath, canonicalOutputPath)); |
371 | 373 | return file; |
372 | 374 | } |
373 | 375 |
|
| 376 | + private static boolean isFileContainedInDirectory(Path directory, Path file) { |
| 377 | + return !file.equals(directory) && file.startsWith(directory); |
| 378 | + } |
| 379 | + |
374 | 380 | @FunctionalInterface |
375 | 381 | private interface EntryNameTransformer { |
376 | 382 |
|
@@ -515,9 +521,9 @@ private boolean shouldExtractLayer(String layer) { |
515 | 521 | } |
516 | 522 |
|
517 | 523 | private File assertLayerDirectoryLocation(File layerDirectory, String layerName) throws IOException { |
518 | | - String canonicalOutputPath = this.directory.getCanonicalPath() + File.separator; |
519 | | - String canonicalLayerPath = layerDirectory.getCanonicalPath(); |
520 | | - Assert.state(canonicalLayerPath.startsWith(canonicalOutputPath), |
| 524 | + Path canonicalOutputPath = this.directory.getCanonicalFile().toPath(); |
| 525 | + Path canonicalLayerPath = layerDirectory.getCanonicalFile().toPath(); |
| 526 | + Assert.state(isFileContainedInDirectory(canonicalOutputPath, canonicalLayerPath), |
521 | 527 | () -> "Layer '%s' would be written to '%s'. This is outside the output location of '%s'. Verify the contents of your archive." |
522 | 528 | .formatted(layerName, canonicalLayerPath, canonicalOutputPath)); |
523 | 529 | return layerDirectory; |
|
0 commit comments