Improve the checks for relative traversal.

zeroturnaround / zt-zip

ZeroTurnaround ZIP Library

http://www.zeroturnaround.com/

Apache License 2.0

1.38k stars 251 forks source link

Improve the checks for relative traversal. #158

Open LQxdu opened 1 month ago

LQxdu commented 1 month ago

Use java.nio.file.Path for consistent sub-directory checking

nemecec commented 1 month ago

Currently, zt-zip is compatible with Java 6. This patch uses Java 7 API. We have to ponder whether it is time to bump the minimum Java requirement from Java 6 to Java 8.

LQxdu commented 1 month ago

Based on recent statistical research, such as reports from InfoWorld and New Relic, Java 8, 11, and 17 are the most widely used versions, while the number of users still relying on Java 6 and 7 has significantly decreased. For instance, according to the New Relic report, only 0.28% of applications are still using Java 7 in production.

Therefore, I believe it is worth considering raising the minimum Java requirement from Java 6 to Java 8.