From 965fd66e0f2111b5e1eb67495282f74d25b3495c Mon Sep 17 00:00:00 2001
From: Sergey Toshin <bugi@Sergeys-MacBook-Pro.local>
Date: Wed, 3 Jan 2018 19:50:16 +0100
Subject: [PATCH] Adds more checks for file write ops

---
 .DS_Store                                     | Bin 10244 -> 12292 bytes
 .../java/jadx/core/codegen/CodeWriter.java    |   7 +++++++
 .../java/jadx/core/dex/visitors/SaveCode.java |   3 ++-
 .../jadx/core/utils/files/ZipSecurity.java    |   9 +++++----
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.DS_Store b/.DS_Store
index eb8e5a2f76e7f895048bfbd2c6f5f283a13ae610..9a8354cc69259d84d3161e7e61076889ad393455 100644
GIT binary patch
literal 12292
zcmeI2ZEPGz8ONW$<CooSQm=!1zH@xZ5!a35*oo~pPTbh${FcNtY0}z>ohFTQ=Ud`y
z&v)+a*^cA7m=_@gX$vZCXbT7dY6U4mv;+wxD2NYGDDOdppn`Z8AOYeFDx!jCX7<kK
z^EosLYND_!?at23&h5_Z^X&Y8&m0k<dot2QR7*q}?;<r<5)~Rmftxs!wTXJMFWFXb
z33%sr#OEealwuT#*;75?*pjQ=0(S)55xAa4pnxAn_-`TaMHHsVZ2wJ!i3*b8iCEN5
zH8x&A!HUA7;u1|aZu0Ib+ii@PtEZyY^!|xdG!eHCSxKAI5wp}DOHB8VCgKN@mZ%>Z
zO~fY0<MxPIHX4eJPR2qht1A{8h@P_S;goeUCC=`#6UkJMyl^<mZAICLX-?YK-4-{9
zPFcO&%r>E)U3p98y6W17=I!lW=U3faYL=}wjC-OHE1rtJEovnXPDdlDvBM#I)QU%<
z@e@N+Q9BxrS%dM=xK&m#rt7kmr^4$Uo(xAHn2e@o%xX=OrE99Z#?c7hX<s5Del232
z)715WDzEp5sOd>se2h2^ZmsbegEl{`8FDV%SZ5f6_ebLq({^sPd5hsa7z>51m>JR4
zeYUn3-k~WqV&)xA;f^-LJ3N{gALp*vWvF+GJ377IW8%(xLw0Kagcawf`j&J1Zhor6
zqOL0v5znMm2gPTcx9VV{I??&V?W4^Uq&;+$ESjJhI!%wzqx3X=iatl@=tcS_y-eSy
zAJ7l!BK?MbN57{((BJ4a`ZoxG0S_wR#hY;(YOxV@*oqyv9XrvEKHPzQxD)#^jN=Gn
z6cLPL3Ntu`S-cyM;c+~HGx#_@gR^)JpT!sPqI$3bVRvHdS4sMauW|R!n>UxP3U>K?
z`Fd_vcs+gVe7^iWmoHj3A^W|aTBw~4&|!+uH23>)dV)SdXXyp{5`BZd$G!d${g^J$
zujr5TS9+EHN&lkPP>fPkVJ+4n!2R8ZR%}NQUFbnC`f)b~a1e)Zg!^jY1jZ1@G)~GM
zzYC}FFg}0};wgL*&*KX?Cwh#R@NIktFXJb;h@Y#TX8OM`-E)=V6;2EJjh$d$Oz})Q
z5spbuJeJQB{kwJ>y;&}EIo`+jao&NJGv6<MA~)xbfI9;Jmm?s)4*}jq8g$ZmmC8>C
zAB2Pu^+H0(jnA0_WLdyTgHAfHQrVQ-$flgCrs9jO>Sc2-4><Xtlg_JDH7BU%1n16h
z2nDJ+As{a&1Xb!D-4Sp{VCe`HbJ1e$pH>`0`4mTGU-_<Ur2T)kQVISymEW?qdc&s1
zZMVNABbal9;vyBFE!?GAS8`m+^t23@vhh4)fv<9n;ZIXTE=?R{VQ-z(ggQ4%)YXB?
z^%@IuQ<GVvrc&3L8dP0PWu2y(1*)c@a*NKGV6ISg%|?sHKwuWB+U-W0&d6XEs@is=
zQ)4nPi&brx(W47^G3l}-zL2_KW_d3p?k`x{|Cwd|t1RhDP$nh)8Yy!(u&l4cCNxN)
z+s4vf2;DyH#sS>LVt0_m?uaArEf%{8Jb)xpn8QPu$2+hfdLP4w@KHRYY%C*i_bj$K
zJiFN7rUsJnSR#IcOU0L6r~4?xa{VMV&?qG+Nmh8;c1)69N}J?QGdQYi`YQe20jAD@
zR46rRcZZTkMD9Q+H5PWx2NQ`{<~$TW#9TUJmiHv$sZca-C1qn~NWSFg5WnKYba!Gh
z9<k-`45$iC=NpZf-r3parfv0s)|R>Yz-&`<<Bs}3TkF=jIbEx$Y3k@dK0b45_QAP_
zo>ZNNGg(oo%4d#G<?pJBoGnk@o?Yd}o-5S*`Di;2Was7j1)f|2;KpjBd^vx~0&{7<
z%FBcodn!CWjlnwu;S%}QRC)3MxPZYxmB*9q#|{A-HJ%N^tE5{?hBxXAc1~ND-mO@F
zi_s)pO?ka4YB5@cf2F-&6}A~WrE6zCD)N~+Iz678uZsk5@l@UXRQWOV@(J|U^jl`{
zztBHW$OKvfjh)mlDO6DRCe))zQg;VB*+KU*ckgEhU2x6&*(E2LLuc?#yr22=BkYPF
z!?XB2bLb09qF=#RmGxyDa|wAbYm=9p5&UeE8?LEME}9r>>zi741~cz4=ha>1#GodC
z+-V_g{$`1a+xR#_;Sc!J6NAVaHGVeKbDD|svbM&*DKj-RZ1x-G3K>EY6HxP3!*3SJ
zV3Ejf-(eVLp$sR9Y<maS7R#uS$aZyeEy=*v!qlLGKKX(lpQh*O>m2yFNWWxb`xE`0
z&5hXHR&tPMEdr><t*F6fY+++-Mhk?osnCZoxI5Y44s+n+UL4~YVGQ>n#^D|j{+Qu#
z&x1T8ya(^a``G+WbKvI;8{yN^3}4TTkmtLfGc#nqo$iS{0`3U7BjApJI|A+qT<r)H
z@egFy8*Wt8%5*Rbu+F4eGJ9#$*Z)>y?==;(3|Rj4x5?;6uOgbu1}qkarmxahmDZ)X
zdUYvytzG9^2E3|yr7a(L)%xmkz^lRF07o`>`J5O>7I^tM&ani%d?MN*lygS3yX${%
z!1~|+CLXYuz2v%l<~8Q9SGE~lG7h&0(o{f<gK}5QUVdgTO|X}W#BHowgj>8mpN(6*
zHlK}KyeglKTOFMl+>#u}Sl6pF)Ge@=T7O=4^;rSfcX{3U0=*&;?DYefz^}V_{aFB*
z2*`ybfQf+Igaj}VkbAoXu!r#o9>s_8q!R~t24~eYu`K&Pmpu#QfLB&@_=cPx<Ucwt
zX^>ZMgV!Pd^BWg)KX0{S{l9Pd|NqI0+=Dv;?g-qNBY?u*f!=QJTY9-7x0_<EJ;3{M
z-o+-an^&o9!UtzLUe?K_crJ7PgeJ>^e7R^huTt5J^Qze!_9p-inY!~ozk%G?zdQen
Rzj6N8h2bmKpx5F2{~r#7@ml}@

delta 1030
zcmcK2Ur19?90%~<*Uh@8O+9YzZnG}Umd-!(fB7d(RQyX&R+?cCIo*{;OS7qgR2$`E
z7V}h)K@rkJ8iWjk2zo3if(Rjsf{5s$mmce(tmAG(^inS#IOlhMzu)C@?}y)1|5TTY
zh|oM9EGP2Ft0MPm<ktA88ZU8+GQT-Z=EUTNtW)BaYiNBu*2!eHx)e)d(d9HJeAW*p
zFk#EPhf2|4Zx?oRK{m6fZCULdhdCdQ===0=U@SDDw*<!Yi0D(B#jM#Pnz&tMY{BZt
z-t5gUuBfhWT24#P;LOIv-JDW!I!lvpy_Qwn#d1|2;{l~R5}MSFX9}60@d)ca8X68J
zD{3h#S9p;1gaZS5*eGpdRSMt5dMES~k<iGnQLJTkBEH2giX2tqT`G%m$X|DppBku*
z`e=}b=_H+}X}UnOG)D`xNDt@{J*Fr0l%CTodQETWEq$cV^o>^N2M7!fsBprA9C)!6
z1*kwJwxbGlXhAF5(ShCQ#X<Dp5C##(F&xJzCUFjq8C=3;T)_?8#yl2q2TOP;POb9@
zEB8xAO)~oa!6==csUdk*J9k7`t|qmX6pm%L)1_*;T9Kmglx5ZFau=6qjGH7SOQsc-
zOyj9iO-ZKJHH>kyWHq|=J7ssB1T?x$&9Y0GDMuJnyp8$B40s#MjLUDt=--MrX`b#&
z!58#Wy1l1QQtm6Qz>IXM=E6p7f`&Z!q+22UNw*r*{<3S6c6+fOJvbl*`!RqZbPQoc
z`b98?ahyR6XQkv6rg0H73Pe)$x)^bJ=VG=EnI_{4Jr)^TR|h<iseCbs41cHCV^x$C
bWA^h!zyE4<EoJ@#Cb*U|f5IeUw(s}}ww%=%

diff --git a/jadx-core/src/main/java/jadx/core/codegen/CodeWriter.java b/jadx-core/src/main/java/jadx/core/codegen/CodeWriter.java
index 1db7a9146..9041a5edf 100644
--- a/jadx-core/src/main/java/jadx/core/codegen/CodeWriter.java
+++ b/jadx-core/src/main/java/jadx/core/codegen/CodeWriter.java
@@ -3,6 +3,7 @@ package jadx.core.codegen;
 import jadx.api.CodePosition;
 import jadx.core.dex.attributes.nodes.LineAttrNode;
 import jadx.core.utils.files.FileUtils;
+import jadx.core.utils.files.ZipSecurity;
 
 import java.io.File;
 import java.io.PrintWriter;
@@ -272,10 +273,16 @@ public class CodeWriter {
 	}
 
 	public void save(File dir, String subDir, String fileName) {
+		if(!ZipSecurity.isValidZipEntryName(subDir) || !ZipSecurity.isValidZipEntryName(fileName)) {
+			return;
+		}
 		save(dir, new File(subDir, fileName).getPath());
 	}
 
 	public void save(File dir, String fileName) {
+		if(!ZipSecurity.isValidZipEntryName(fileName)) {
+			return;
+		}
 		save(new File(dir, fileName));
 	}
 
diff --git a/jadx-core/src/main/java/jadx/core/dex/visitors/SaveCode.java b/jadx-core/src/main/java/jadx/core/dex/visitors/SaveCode.java
index 9cabcb3ae..ec40de3c0 100644
--- a/jadx-core/src/main/java/jadx/core/dex/visitors/SaveCode.java
+++ b/jadx-core/src/main/java/jadx/core/dex/visitors/SaveCode.java
@@ -4,6 +4,7 @@ import jadx.api.IJadxArgs;
 import jadx.core.codegen.CodeWriter;
 import jadx.core.dex.nodes.ClassNode;
 import jadx.core.utils.exceptions.CodegenException;
+import jadx.core.utils.files.ZipSecurity;
 
 import java.io.File;
 
@@ -25,7 +26,7 @@ public class SaveCode extends AbstractVisitor {
 	public static void save(File dir, IJadxArgs args, ClassNode cls) {
 		CodeWriter clsCode = cls.getCode();
 		String fileName = cls.getClassInfo().getFullPath() + ".java";
-		if (args.isFallbackMode()) {
+  		if (args.isFallbackMode()) {
 			fileName += ".jadx";
 		}
 		clsCode.save(dir, fileName);
diff --git a/jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java b/jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
index 8f9f8c257..b5bc23c93 100644
--- a/jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
+++ b/jadx-core/src/main/java/jadx/core/utils/files/ZipSecurity.java
@@ -10,7 +10,7 @@ public class ZipSecurity {
 	private static final Logger LOG = LoggerFactory.getLogger(ZipSecurity.class);
 	
 	// size of uncompressed zip entry shouldn't be bigger of compressed in MAX_SIZE_DIFF times
-	private static final int MAX_SIZE_DIFF = 5;
+	private static final int MAX_SIZE_DIFF = 10;
 	
 	private static boolean isInSubDirectory(File base, File file) {
 	    if (file == null) {
@@ -32,11 +32,11 @@ public class ZipSecurity {
 			if(isInSubDirectory(currentPath, canonical)) {
 				return true;
 			}
-			LOG.debug("Path traversal attack detected, invalid name: {}", entryName);
+			LOG.error("Path traversal attack detected, invalid name: {}", entryName);
 			return false;
 		}
 		catch(Exception e) {
-			LOG.debug("Path traversal attack detected, invalid name: {}", entryName);
+			LOG.error("Path traversal attack detected, invalid name: {}", entryName);
 			return false;
 		}
 	}
@@ -48,7 +48,8 @@ public class ZipSecurity {
 			return true;
 		}
 		if(compressedSize * MAX_SIZE_DIFF < uncompressedSize) {
-			LOG.debug("Zip bomp attack detected, invalid sizes: compressed {}, uncompressed {}", compressedSize, uncompressedSize);
+			LOG.error("Zip bomp attack detected, invalid sizes: compressed {}, uncompressed {}, name {}",
+					compressedSize, uncompressedSize, entry.getName());
 			return true;
 		}
 		return false;