Introduced protections against "zip slip" attacks (#3)

pixeebot[bot] · web-flow · commit cc47b90ba0f4 · 2024-07-19T08:34:18.000-04:00
Co-authored-by: pixeebot[bot] &lt;104101892+pixeebot[bot]@users.noreply.github.com&gt;
diff --git a/interlok-core/src/main/java/com/adaptris/core/lms/ZipFileBackedMessageImpl.java b/interlok-core/src/main/java/com/adaptris/core/lms/ZipFileBackedMessageImpl.java
@@ -16,6 +16,7 @@
 
 package com.adaptris.core.lms;
 
+import io.github.pixee.security.ZipSecurity;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
@@ -70,7 +71,7 @@ private InputStream openInputStream() throws IOException {
       }
     }
     if (isZip) {
-      ZipInputStream zin = new ZipInputStream(super.getInputStream());
+      ZipInputStream zin = ZipSecurity.createHardenedInputStream(super.getInputStream());
       zin.getNextEntry();
       return zin;
     }

Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,7 @@`
`16`	`16`
`17`	`17`	`package com.adaptris.core.lms;`
`18`	`18`
	`19`	`+import io.github.pixee.security.ZipSecurity;`
`19`	`20`	`import java.io.File;`
`20`	`21`	`import java.io.IOException;`
`21`	`22`	`import java.io.InputStream;`
`@@ -70,7 +71,7 @@ private InputStream openInputStream() throws IOException {`
`70`	`71`	`}`
`71`	`72`	`}`
`72`	`73`	`if (isZip) {`
`73`		`- ZipInputStream zin = new ZipInputStream(super.getInputStream());`
	`74`	`+ ZipInputStream zin = ZipSecurity.createHardenedInputStream(super.getInputStream());`
`74`	`75`	`zin.getNextEntry();`
`75`	`76`	`return zin;`
`76`	`77`	`}`