Skip to content

Commit d9b1410

Browse files
(lazy) Potential fix for code scanning alert no. 6: Arbitrary file access during archive extraction ("Zip Slip")
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 4584cf5 commit d9b1410

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

Diff for: common/src/main/java/com/loohp/multichatdiscordsrvaddon/resources/ResourceDownloadManager.java

+8-8
Original file line numberDiff line numberDiff line change
@@ -159,17 +159,17 @@ public void run() {
159159
}
160160
byte[] currentEntry = baos.toByteArray();
161161

162-
File folder = new File(packFolder, name).getParentFile();
163-
File normalizedFolder = folder.toPath().normalize().toFile();
164-
if (!normalizedFolder.toPath().startsWith(packFolder.toPath())) {
162+
File file = new File(packFolder, name);
163+
File normalizedFile = file.toPath().normalize().toFile();
164+
if (!normalizedFile.toPath().startsWith(packFolder.toPath())) {
165165
throw new IOException("Bad zip entry: " + name);
166166
}
167-
normalizedFolder.mkdirs();
168-
File file = new File(normalizedFolder, fileName);
169-
if (file.exists()) {
170-
file.delete();
167+
File folder = normalizedFile.getParentFile();
168+
folder.mkdirs();
169+
if (normalizedFile.exists()) {
170+
normalizedFile.delete();
171171
}
172-
FileUtils.copy(new ByteArrayInputStream(currentEntry), file);
172+
FileUtils.copy(new ByteArrayInputStream(currentEntry), normalizedFile);
173173
}
174174
}
175175
} catch (Exception e) {

0 commit comments

Comments
 (0)