mirror of
https://github.com/BentoBoxWorld/BentoBox.git
synced 2024-09-26 05:42:37 +02:00
Uses path normalization to prevent directory traversal attacks.
This commit is contained in:
parent
1fb6a8a27c
commit
dc42f51168
@ -214,8 +214,11 @@ public class BlueprintClipboardManager {
|
|||||||
}
|
}
|
||||||
|
|
||||||
private void unzipFiles(final ZipInputStream zipInputStream, final Path unzipFilePath) throws IOException {
|
private void unzipFiles(final ZipInputStream zipInputStream, final Path unzipFilePath) throws IOException {
|
||||||
if (!unzipFilePath.toFile().getCanonicalPath().startsWith(blueprintFolder.getCanonicalPath())) {
|
// Prevent directory traversal attacks by normalizing the path
|
||||||
throw new IOException("Entry is outside of the target directory");
|
if (!unzipFilePath.startsWith(blueprintFolder.getCanonicalFile().toPath().normalize())) {
|
||||||
|
throw new IOException(
|
||||||
|
"Blueprint file is trying to write outside of the target directory! Blocked attempt to write to "
|
||||||
|
+ unzipFilePath.toString());
|
||||||
}
|
}
|
||||||
try (BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(unzipFilePath.toFile().getCanonicalPath()))) {
|
try (BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(unzipFilePath.toFile().getCanonicalPath()))) {
|
||||||
byte[] bytesIn = new byte[1024];
|
byte[] bytesIn = new byte[1024];
|
||||||
|
Loading…
Reference in New Issue
Block a user