Fix code scanning alerts #1061
Closed
Fix code scanning alerts #1061
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
Cherry pick to beta failed, 1 conflicted file in commit 91e3b12
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| log.error(DIRECTORY_ATTACK + "{}", entry.getName()); | ||
| return; | ||
| }else { | ||
| File newFile = new File(directory, entry.getName()); |
Check failure
Code scanning / CodeQL
Arbitrary file access during archive extraction ("Zip Slip") High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 14 days ago
To fix the Zip Slip vulnerability, we need to ensure that output paths created using an archive entry's name are securely validated before performing any file system operation. The best way to do this is:
- For every extracted file (across tar, 7z, jar), construct the destination file path and normalize it.
- Check whether the normalized path is under the intended extraction directory by comparing path prefixes (
Path.startsWith()or equivalent using canonical path). - If the path does not start with the intended extraction directory, abort extraction of that entry and possibly log or throw an exception.
- Implement this in both
decompress7z(for eachSevenZArchiveEntry) anddecompressJar(for eachJarEntry), similar to how it is done (perhaps in an auxiliary method) for tar files.
In particular, the following regions require fixes:
- In
decompress7z, after creatingnewFile, validate it before any file system operation. - In
decompressJar, after creatingoutputFile, validate it before any file system operation.
Code imports required:
- Ensure that
java.nio.file.Pathis imported (already is). - Use
toPath().normalize()and compare with the extraction directory's canonical path.
If there's already a helper utility for path traversal check (CompressionUtils.isPathTraversal), use that for cross-format consistency. If not, implement a simple helper locally in this file.
Suggested changeset
1
gxcompress/src/main/java/com/genexus/compression/GXCompressor.java
| @@ -613,6 +613,11 @@ | ||
| try (SevenZFile sevenZFile = new SevenZFile(archive)) { | ||
| SevenZArchiveEntry entry; | ||
| while ((entry = sevenZFile.getNextEntry()) != null) { | ||
| // Added Zip Slip protection for 7z extraction | ||
| if (CompressionUtils.isPathTraversal(directory, entry.getName())) { | ||
| log.error(DIRECTORY_ATTACK + "{}", entry.getName()); | ||
| continue; | ||
| } | ||
| File newFile = new File(directory, entry.getName()); | ||
| if (entry.isDirectory()) { | ||
| if (!newFile.isDirectory() && !newFile.mkdirs()) { | ||
| @@ -771,6 +776,11 @@ | ||
| try (JarInputStream jarInputStream = new JarInputStream(Files.newInputStream(archive.toPath()))) { | ||
| JarEntry entry; | ||
| while ((entry = jarInputStream.getNextJarEntry()) != null) { | ||
| // Added Zip Slip protection for jar extraction | ||
| if (CompressionUtils.isPathTraversal(targetDir.getAbsolutePath(), entry.getName())) { | ||
| log.error(DIRECTORY_ATTACK + "{}", entry.getName()); | ||
| continue; | ||
| } | ||
| File outputFile = new File(targetDir, entry.getName()); | ||
| if (entry.isDirectory()) { | ||
| if (!outputFile.exists() && !outputFile.mkdirs()) { |
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
codeql