[MWRAPPER-21] Arbitrary file write during archive extraction ("Zip Slip") in wrapper

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.1
• Component/s: Maven Wrapper Jar
• Assignee: Robert Scholte
• Reporter: Sylwester Lachiewicz
• Created: 18/Jun/20 11:45
• Updated: 14/May/22 08:31
• Resolved: 14/May/22 08:31

Description

In Maven Wrapper Installer https://github.com/apache/maven/blob/ef8c95eb397651e10f677763dfcd9c8cea7c27b0/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
 

 ZipEntry entry = entries.nextElement();
 if ( entry.isDirectory() )
 {
  continue;
 }
 Path targetFile = dest.resolve( entry.getName() );

// Unsanitized archive entry, which may contain '..', is used in a file system operation.
  // prevent Zip Slip
if ( targetFile.startsWith( dest ) ) 
{
   Files.createDirectories( targetFile.getParent() );
   Files.copy( zipFile.getInputStream( entry ), targetFile );
}

 

 Found via LGTM.com scan

Issue Links

• Is contained by: MWRAPPER-51 Refactor using Java Path API (NIO.2)