[MNG-6942] Arbitrary file write during archive extraction ("Zip Slip") in wrapper

2020-06-20 12:59:22 +02:00 · 2020-06-20 12:59:22 +02:00 · 101caea3c3
parent d35573e06c
commit 101caea3c3
1 changed files with 1 additions and 1 deletions
--- a/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
+++ b/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
@ -211,7 +211,7 @@ public class Installer
                    continue;
                }

-                Path targetFile = dest.resolve( entry.getName() );
+                Path targetFile = dest.resolve( entry.getName() ).normalize();

                // prevent Zip Slip
                if ( targetFile.startsWith( dest ) )