search

spring-projects / spring-integration-extensions

The Spring Integration Extensions project provides extension components for Spring Integration
http://www.springintegration.org/
281 stars 266 forks source link

Disallow traversal entity in zip #189

Closed artembilan closed 6 years ago

artembilan commented 6 years ago

When the file name holds path traversal file names it gets concatenated to the target extraction directory, the final path ends up outside of the target folder.

artembilan commented 6 years ago

Merged as https://github.com/spring-projects/spring-integration-extensions/commit/a5573eb232ff85199ff9bb28993df715d9a19a25