Revert "Introduced protections against "zip slip" attacks (#1)" (#3)

pixeeai · web-flow · commit 659f4e1fb2e9 · 2024-07-22T21:53:44.000-04:00
This reverts commit 68d534e.
diff --git a/core/src/main/java/io/kestra/plugin/core/flow/WorkingDirectory.java b/core/src/main/java/io/kestra/plugin/core/flow/WorkingDirectory.java
@@ -1,7 +1,6 @@
 package io.kestra.plugin.core.flow;
 
 import com.fasterxml.jackson.core.type.TypeReference;
-import io.github.pixee.security.ZipSecurity;
 import io.kestra.core.exceptions.IllegalVariableEvaluationException;
 import io.kestra.core.models.annotations.Example;
 import io.kestra.core.models.annotations.Plugin;
@@ -243,7 +242,7 @@ public void preExecuteTasks(RunContext runContext, TaskRun taskRun) throws Excep
             if (maybeCacheFile.isPresent()) {
                 runContext.logger().debug("Cache exist, downloading it");
                 // download the cache if exist and unzip all entries
-                try (ZipInputStream archive = ZipSecurity.createHardenedInputStream(maybeCacheFile.get())) {
+                try (ZipInputStream archive = new ZipInputStream(maybeCacheFile.get())) {
                     ZipEntry entry;
                     while ((entry = archive.getNextEntry()) != null) {
                         if (!entry.isDirectory()) {
diff --git a/webserver/src/main/java/io/kestra/webserver/controllers/api/FlowController.java b/webserver/src/main/java/io/kestra/webserver/controllers/api/FlowController.java
@@ -1,6 +1,5 @@
 package io.kestra.webserver.controllers.api;
 
-import io.github.pixee.security.ZipSecurity;
 import io.kestra.core.exceptions.IllegalVariableEvaluationException;
 import io.kestra.core.exceptions.InternalException;
 import io.kestra.core.models.SearchResult;
@@ -755,7 +754,7 @@ public HttpResponse<Void> importFlows(
                 this.importFlow(tenantId, source.trim());
             }
         } else if (fileName.endsWith(".zip")) {
-            try (ZipInputStream archive = ZipSecurity.createHardenedInputStream(fileUpload.getInputStream())) {
+            try (ZipInputStream archive = new ZipInputStream(fileUpload.getInputStream())) {
                 ZipEntry entry;
                 while ((entry = archive.getNextEntry()) != null) {
                     if (entry.isDirectory() || !entry.getName().endsWith(".yml") && !entry.getName().endsWith(".yaml")) {
diff --git a/webserver/src/main/java/io/kestra/webserver/controllers/api/NamespaceFileController.java b/webserver/src/main/java/io/kestra/webserver/controllers/api/NamespaceFileController.java
@@ -1,6 +1,5 @@
 package io.kestra.webserver.controllers.api;
 
-import io.github.pixee.security.ZipSecurity;
 import io.kestra.core.services.FlowService;
 import io.kestra.core.storages.FileAttributes;
 import io.kestra.core.storages.NamespaceFile;
@@ -138,7 +137,7 @@ public void createFile(
     ) throws IOException, URISyntaxException {
         String tenantId = tenantService.resolveTenant();
         if(fileContent.getFilename().toLowerCase().endsWith(".zip")) {
-            try (ZipInputStream archive = ZipSecurity.createHardenedInputStream(fileContent.getInputStream())) {
+            try (ZipInputStream archive = new ZipInputStream(fileContent.getInputStream())) {
                 ZipEntry entry;
                 while ((entry = archive.getNextEntry()) != null) {
                     if (entry.isDirectory()) {
diff --git a/webserver/src/main/java/io/kestra/webserver/controllers/api/TemplateController.java b/webserver/src/main/java/io/kestra/webserver/controllers/api/TemplateController.java
@@ -1,6 +1,5 @@
 package io.kestra.webserver.controllers.api;
 
-import io.github.pixee.security.ZipSecurity;
 import io.kestra.core.models.templates.Template;
 import io.kestra.core.models.templates.TemplateEnabled;
 import io.kestra.core.models.validations.ManualConstraintViolation;
@@ -357,7 +356,7 @@ public HttpResponse<Void> importTemplates(@Parameter(description = "The file to
                 importTemplate(parsed);
             }
         } else if (fileName.endsWith(".zip")) {
-            try (ZipInputStream archive = ZipSecurity.createHardenedInputStream(fileUpload.getInputStream())) {
+            try (ZipInputStream archive = new ZipInputStream(fileUpload.getInputStream())) {
                 ZipEntry entry;
                 while ((entry = archive.getNextEntry()) != null) {
                     if (entry.isDirectory() || !entry.getName().endsWith(".yml") && !entry.getName().endsWith(".yaml")) {
