Skip to content

Fix zip slip check in StructContext on Windows #3357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Miguel0888 wants to merge 3 commits into
base: master
Choose a base branch
from
+2 −2
Open

Fix zip slip check in StructContext on Windows #3357

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
455a6bc
Add note for zip-slip fix cherry-pick
Miguel0888 Dec 21, 2025
1a1fcf7
Fix ZipEntry traversal check (from JetBrains/fernflower#22)
Miguel0888 Dec 21, 2025
d6accd1
Delete zip-slip-fix-note.txt
Miguel0888 Dec 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions plugins/java-decompiler/engine/src/org/jetbrains/java/decompiler/struct/StructContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,8 +139,8 @@ private void addArchive(String path, File file, int type, boolean isOwn) throws
}

String name = entry.getName();
File test = new File(file.getAbsolutePath(), name);
if (!test.getCanonicalPath().startsWith(file.getCanonicalPath() + File.separator)) { // check for zip slip exploit
String normalizedName = name.replace('\\', '/');
if (normalizedName.startsWith("/") || normalizedName.startsWith(".." + "/") || normalizedName.contains("/" + ".." + "/")) { // check for zip slip exploit
Copy link

Copilot AI Dec 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The string concatenation using the + operator should be replaced with string literals for better performance and readability. Instead of ".." + "/" and "/" + ".." + "/", use "../" and "/../" directly. While the compiler may optimize simple concatenations, using string literals is clearer and avoids any potential runtime concatenation overhead.

Suggested change
if (normalizedName.startsWith("/") || normalizedName.startsWith(".." + "/") || normalizedName.contains("/" + ".." + "/")) { // check for zip slip exploit
if (normalizedName.startsWith("/") || normalizedName.startsWith("../") || normalizedName.contains("/../")) { // check for zip slip exploit

Copilot uses AI. Check for mistakes.
throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory");
}
Comment on lines +143 to 145
Copy link

Copilot AI Dec 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The zip slip check may not catch all path traversal attempts. Consider these edge cases:

  1. Entry names that are exactly .. (would not be caught by startsWith("../"))
  2. Entry names ending with /.. like somedir/.. (would not be caught by contains("/../"))
  3. Entry names ending with .. without a slash like foo/bar.. should be allowed, but foo/bar/.. should be rejected

The check should handle these cases to be more comprehensive. Consider using a pattern that checks for .. as a complete path component, such as checking if the normalized name equals ".." or checking for the pattern "/.." at the end of the string or followed by /.

Suggested change
if (normalizedName.startsWith("/") || normalizedName.startsWith(".." + "/") || normalizedName.contains("/" + ".." + "/")) { // check for zip slip exploit
throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory");
}
if (normalizedName.startsWith("/")) { // check for zip slip exploit: absolute path
throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory");
}
for (String component : normalizedName.split("/")) { // check for zip slip exploit: parent directory traversal
if ("..".equals(component)) {
throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory");
}
}

Copilot uses AI. Check for mistakes.

Expand Down
Loading