jessikitty/jadx
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: speed up file path security checks (PR #2745)

Browse Source 
chore: Speed up path traversal check by using java.nio.file
This commit is contained in:
Jan S.
2026-01-16 19:36:48 +01:00
committed by GitHub
parent ae1a5e9277
commit a0466d4494
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jadx-commons/jadx-zip/src/main/java/jadx/zip/security/JadxZipSecurity.java
+9 -12
View File
@@ -2,6 +2,8 @@ package jadx.zip.security;
import java.io.File;
import java.io.IOException;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -11,7 +13,7 @@ import jadx.zip.IZipEntry;
public class JadxZipSecurity implements IJadxZipSecurity {
private static final Logger LOG = LoggerFactory.getLogger(JadxZipSecurity.class);
private static final File CWD = getCWD();
private static final Path CWD = Paths.get(".").toAbsolutePath().normalize();
/**
* The size of uncompressed zip entry shouldn't be bigger of compressed in zipBombDetectionFactor
@@ -56,14 +58,17 @@ public class JadxZipSecurity implements IJadxZipSecurity {
return false;
}
}
// Path traversal check as presented on
// https://www.heise.de/en/background/Secure-Coding-Best-practices-for-using-Java-NIO-against-path-traversal-9996787.html
try {
File currentPath = CWD;
File canonical = new File(currentPath, entryName).getCanonicalFile();
if (isInSubDirectoryInternal(currentPath, canonical)) {
Path entryPath = CWD.resolve(entryName).normalize();
if (entryPath.startsWith(CWD)) {
return true;
}
} catch (Exception e) {
// check failed
LOG.error("Invalid file name or path traversal attack detected: {} - error: {}", entryName, e.getMessage());
return false;
}
LOG.error("Invalid file name or path traversal attack detected: {}", entryName);
return false;
@@ -121,12 +126,4 @@ public class JadxZipSecurity implements IJadxZipSecurity {
this.useLimitedDataStream = useLimitedDataStream;
}
private static File getCWD() {
try {
return new File(".").getCanonicalFile();
} catch (IOException e) {
throw new RuntimeException("Failed to init current working dir constant", e);
}
}
}