fix zipSlip

https://github.com/eclipse-jdt/eclipse.jdt.core/security/code-scanning/34
gayanper · Sep 7, 2024 · b695e79 · b695e79
1 parent 3f0e748
commit b695e79
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java
@@ -151,6 +151,9 @@ protected boolean computeChildren(OpenableElementInfo info, IResource underlying
 				for (Enumeration<? extends ZipEntry> e= jar.entries(); e.hasMoreElements();) {
 					ZipEntry member= e.nextElement();
 					String name = member.getName();
+					if (name.contains("..")) { //$NON-NLS-1$
+						throw new IllegalArgumentException("Bad zip entry: "+name+" in "+jar.getName()); //$NON-NLS-1$ //$NON-NLS-2$
+					}
 					if (this.multiVersion && name.length() > (length + 2) && name.startsWith(version)) {
 						int end = name.indexOf('/', length);
 						if (end >= name.length()) continue;