Skip to content

Commit b58404c

Browse files
committed
fix(android): resolve zip path traversal vulnerability
Fixes #42
1 parent 6fdbc77 commit b58404c

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

android/src/main/java/com/alpha0010/fs/FileAccessModule.kt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,9 @@ class FileAccessModule(reactContext: ReactApplicationContext) :
403403
while (entry != null) {
404404
val targetFile = File(targetFolder, entry.name)
405405
when {
406+
!targetFile.canonicalPath.startsWith(targetFolder.canonicalPath) -> {
407+
throw SecurityException("Failed to extract invalid filename '${entry.name}'.")
408+
}
406409
entry.isDirectory -> {
407410
targetFile.mkdirs()
408411
}

0 commit comments

Comments
 (0)