From f58e9a8c197ab342f6495e8becaf55876e479a01 Mon Sep 17 00:00:00 2001
From: Piotr Krysiak <piotr.krysiak@nokia.com>
Date: Wed, 18 Jul 2018 14:35:48 +0200
Subject: Fix zip-slip in openecomp-be

Issue-ID: SDC-1401

Change-Id: I92cf8184ab50cb1d3b1ba2f71eab8f5701e1ee57
Signed-off-by: Piotr Krysiak <piotr.krysiak@nokia.com>
---
 .../org/openecomp/core/tools/util/ZipUtils.java    | 47 +++++++++++++---------
 1 file changed, 29 insertions(+), 18 deletions(-)

(limited to 'openecomp-be/tools/zusammen-tools/src/main/java')

diff --git a/openecomp-be/tools/zusammen-tools/src/main/java/org/openecomp/core/tools/util/ZipUtils.java b/openecomp-be/tools/zusammen-tools/src/main/java/org/openecomp/core/tools/util/ZipUtils.java
index 96c7f17084..a2ea76d308 100644
--- a/openecomp-be/tools/zusammen-tools/src/main/java/org/openecomp/core/tools/util/ZipUtils.java
+++ b/openecomp-be/tools/zusammen-tools/src/main/java/org/openecomp/core/tools/util/ZipUtils.java
@@ -13,6 +13,7 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.zip.ZipEntry;
+import java.util.zip.ZipException;
 import java.util.zip.ZipInputStream;
 import java.util.zip.ZipOutputStream;
 
@@ -45,33 +46,43 @@ public class ZipUtils {
         if (zipFile == null || outputFolder == null) {
             return;
         }
-        if (!outputFolder.toFile().exists()) {
-            Files.createDirectories(outputFolder);
-        }
+        createDirectoryIfNotExists(outputFolder);
 
         try (FileInputStream fileInputStream = new FileInputStream(zipFile.toFile());
-             ZipInputStream zis = new ZipInputStream(fileInputStream)) {
-            ZipEntry ze = zis.getNextEntry();
-            while (ze != null) {
-                String fileName = ze.getName();
+             ZipInputStream stream = new ZipInputStream(fileInputStream)) {
+
+            ZipEntry entry;
+            while ((entry = stream.getNextEntry()) != null) {
+                assertEntryNotVulnerable(entry);
+                String fileName = entry.getName();
                 File newFile = new File(outputFolder.toString() + File.separator + fileName);
-                if (ze.isDirectory()) {
-                    Path path = newFile.toPath();
-                    if (!path.toFile().exists()) {
-                        Files.createDirectories(path);
-                    }
+                if (entry.isDirectory()) {
+                    createDirectoryIfNotExists(newFile.toPath());
                 } else {
-                    new File(newFile.getParent()).mkdirs();
-                    try (FileOutputStream fos = new FileOutputStream(newFile)) {
-                        ByteStreams.copy(zis, fos);
-                    }
+                    persistFile(stream, newFile);
                 }
-                ze = zis.getNextEntry();
             }
+        }
+
+    }
 
-            zis.closeEntry();
+    private static void persistFile(ZipInputStream stream, File newFile) throws IOException {
+        new File(newFile.getParent()).mkdirs();
+        try (FileOutputStream outputStream = new FileOutputStream(newFile)) {
+            ByteStreams.copy(stream, outputStream);
         }
+    }
 
+    private static void createDirectoryIfNotExists(Path path) throws IOException {
+        if (!path.toFile().exists()) {
+            Files.createDirectories(path);
+        }
+    }
+
+    private static void assertEntryNotVulnerable(ZipEntry entry) throws ZipException {
+        if (entry.getName().contains("../")) {
+            throw new ZipException("Path traversal attempt discovered.");
+        }
     }
 }
 
-- 
cgit 1.2.3-korg