Skip to content
This repository was archived by the owner on Feb 1, 2024. It is now read-only.

Commit e0ecb56

Browse files
authored
Codeql detects zipslip vulnerability (open-telemetry#8209)
I think that the only way zipslip could happen is when name contains `..` but codeql isn't able to cope with that. Removing the `..` check gets rid of the code scanning alert.
1 parent b52bad1 commit e0ecb56

File tree

1 file changed

+4
-5
lines changed

1 file changed

+4
-5
lines changed

javaagent-tooling/src/main/java/io/opentelemetry/javaagent/tooling/ExtensionClassLoader.java

+4-5
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,10 @@ private static void includeEmbeddedExtensionsIfFound(
9191
File tempFile = new File(tempDirectory, name.substring(prefix.length()));
9292
// reject extensions that would be extracted outside of temp directory
9393
// https://security.snyk.io/research/zip-slip-vulnerability
94-
if (name.indexOf("..") != -1
95-
&& !tempFile
96-
.getCanonicalFile()
97-
.toPath()
98-
.startsWith(tempDirectory.getCanonicalFile().toPath())) {
94+
if (!tempFile
95+
.getCanonicalFile()
96+
.toPath()
97+
.startsWith(tempDirectory.getCanonicalFile().toPath())) {
9998
throw new IllegalStateException("Invalid extension " + name);
10099
}
101100
if (tempFile.createNewFile()) {

0 commit comments

Comments
 (0)