From f58e9a8c197ab342f6495e8becaf55876e479a01 Mon Sep 17 00:00:00 2001 From: Piotr Krysiak Date: Wed, 18 Jul 2018 14:35:48 +0200 Subject: Fix zip-slip in openecomp-be Issue-ID: SDC-1401 Change-Id: I92cf8184ab50cb1d3b1ba2f71eab8f5701e1ee57 Signed-off-by: Piotr Krysiak --- .../src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java | 9 ++++++++- .../java/org/openecomp/sdc/translator/utils/ResourceWalker.java | 2 +- 2 files changed, 9 insertions(+), 2 deletions(-) (limited to 'openecomp-be/lib') diff --git a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java index 206eae3491..dfd6b8d250 100644 --- a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java +++ b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/utils/CommonUtil.java @@ -47,6 +47,7 @@ import java.util.Objects; import java.util.Optional; import java.util.Set; import java.util.zip.ZipEntry; +import java.util.zip.ZipException; import java.util.zip.ZipInputStream; public class CommonUtil { @@ -95,8 +96,8 @@ public class CommonUtil { String currentEntryName; while ((zipEntry = inputZipStream.getNextEntry()) != null) { + assertEntryNotVulnerable(zipEntry); currentEntryName = zipEntry.getName(); - // else, get the file content (as byte array) and save it in a map. fileByteContent = FileUtils.toByteArray(inputZipStream); int index = lastIndexFileSeparatorIndex(currentEntryName); @@ -115,6 +116,12 @@ public class CommonUtil { return new ImmutablePair<>(mapFileContent, folderList); } + private static void assertEntryNotVulnerable(ZipEntry entry) throws ZipException { + if (entry.getName().contains("../")) { + throw new ZipException("Path traversal attempt discovered."); + } + } + private static boolean isFile(String currentEntryName) { return !(currentEntryName.endsWith("\\") || currentEntryName.endsWith("/")); } diff --git a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/utils/ResourceWalker.java b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/utils/ResourceWalker.java index e5993677cd..93a2290938 100644 --- a/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/utils/ResourceWalker.java +++ b/openecomp-be/lib/openecomp-sdc-translator-lib/openecomp-sdc-translator-core/src/main/java/org/openecomp/sdc/translator/utils/ResourceWalker.java @@ -123,7 +123,7 @@ public class ResourceWalker { return zipEntry -> { String name = zipEntry.getName(); return (name.equals(resource) || name.startsWith(resource + "/")) - && !zipEntry.isDirectory(); + && !zipEntry.isDirectory() && !name.contains("../"); }; } } -- cgit 1.2.3-korg