From 6216a96ff8958ed36e973f5f23eaa1840db4dfef Mon Sep 17 00:00:00 2001 From: Husky <2466896229@qq.com> Date: Thu, 24 Mar 2022 15:51:40 +0800 Subject: [PATCH 1/4] issue #I4ZDQI --- .../src/main/java/cn/hutool/core/compress/ZipReader.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java index 824a8328d..29b09746c 100755 --- a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java +++ b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java @@ -4,6 +4,7 @@ import cn.hutool.core.io.FileUtil; import cn.hutool.core.io.IORuntimeException; import cn.hutool.core.io.IoUtil; import cn.hutool.core.lang.Filter; +import cn.hutool.core.util.StrUtil; import cn.hutool.core.util.ZipUtil; import java.io.Closeable; @@ -142,8 +143,10 @@ public class ZipReader implements Closeable { public File readTo(File outFile, Filter entryFilter) throws IORuntimeException { read((zipEntry) -> { if (null == entryFilter || entryFilter.accept(zipEntry)) { + //gitee issue #I4ZDQI + String replace = StrUtil.replace(zipEntry.getName(), "*", "_"); // FileUtil.file会检查slip漏洞，漏洞说明见http://blog.nsfocus.net/zip-slip-2/ - final File outItemFile = FileUtil.file(outFile, zipEntry.getName()); + final File outItemFile = FileUtil.file(outFile, replace); if (zipEntry.isDirectory()) { // 目录 //noinspection ResultOfMethodCallIgnored From a294582d054f4ee3e19443858089bb1634a2e570 Mon Sep 17 00:00:00 2001 From: Husky <2466896229@qq.com> Date: Thu, 24 Mar 2022 16:16:30 +0800 Subject: [PATCH 2/4] =?UTF-8?q?issue=20#I4ZDQI=20=E4=BF=AE=E6=94=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/cn/hutool/core/compress/ZipReader.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java index 29b09746c..173e4136a 100755 --- a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java +++ b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java @@ -144,7 +144,10 @@ public class ZipReader implements Closeable { read((zipEntry) -> { if (null == entryFilter || entryFilter.accept(zipEntry)) { //gitee issue #I4ZDQI - String replace = StrUtil.replace(zipEntry.getName(), "*", "_"); + String replace = zipEntry.getName(); + if (System.getProperty("os.name").contains("Windows")) { + replace = StrUtil.replace(zipEntry.getName(), "*", "_"); + } // FileUtil.file会检查slip漏洞，漏洞说明见http://blog.nsfocus.net/zip-slip-2/ final File outItemFile = FileUtil.file(outFile, replace); if (zipEntry.isDirectory()) { From bdaad75554e21a6807ca50f65ca550a298462cdb Mon Sep 17 00:00:00 2001 From: Husky <2466896229@qq.com> Date: Thu, 24 Mar 2022 16:18:20 +0800 Subject: [PATCH 3/4] =?UTF-8?q?issue=20#I4ZDQI=20=E8=A7=84=E8=8C=83?= =?UTF-8?q?=E5=91=BD=E5=90=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/cn/hutool/core/compress/ZipReader.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java index 173e4136a..8886fb0e2 100755 --- a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java +++ b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java @@ -144,12 +144,12 @@ public class ZipReader implements Closeable { read((zipEntry) -> { if (null == entryFilter || entryFilter.accept(zipEntry)) { //gitee issue #I4ZDQI - String replace = zipEntry.getName(); + String path = zipEntry.getName(); if (System.getProperty("os.name").contains("Windows")) { - replace = StrUtil.replace(zipEntry.getName(), "*", "_"); + path = StrUtil.replace(zipEntry.getName(), "*", "_"); } // FileUtil.file会检查slip漏洞，漏洞说明见http://blog.nsfocus.net/zip-slip-2/ - final File outItemFile = FileUtil.file(outFile, replace); + final File outItemFile = FileUtil.file(outFile, path); if (zipEntry.isDirectory()) { // 目录 //noinspection ResultOfMethodCallIgnored From 82c3852e51bbecf585a6755804416dcb020a5997 Mon Sep 17 00:00:00 2001 From: Husky <2466896229@qq.com> Date: Thu, 24 Mar 2022 16:22:20 +0800 Subject: [PATCH 4/4] =?UTF-8?q?issue=20#I4ZDQI=20=E4=BF=AE=E6=94=B9?= =?UTF-8?q?=E5=88=A4=E6=96=AD=E6=96=B9=E6=B3=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/cn/hutool/core/compress/ZipReader.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java index 8886fb0e2..7ba843c2d 100755 --- a/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java +++ b/hutool-core/src/main/java/cn/hutool/core/compress/ZipReader.java @@ -145,7 +145,7 @@ public class ZipReader implements Closeable { if (null == entryFilter || entryFilter.accept(zipEntry)) { //gitee issue #I4ZDQI String path = zipEntry.getName(); - if (System.getProperty("os.name").contains("Windows")) { + if (System.getProperty("os.name").toLowerCase().startsWith("win")) { path = StrUtil.replace(zipEntry.getName(), "*", "_"); } // FileUtil.file会检查slip漏洞，漏洞说明见http://blog.nsfocus.net/zip-slip-2/