26 lines
987 B
Diff
26 lines
987 B
Diff
--- a/src/main/java/org/codehaus/plexus/util/Expand.java
|
|
+++ b/src/main/java/org/codehaus/plexus/util/Expand.java
|
|
@@ -116,9 +116,20 @@
|
|
{
|
|
File f = FileUtils.resolveFile( dir, entryName );
|
|
|
|
- if ( !f.getAbsolutePath().startsWith( dir.getAbsolutePath() ) )
|
|
+ try
|
|
+ {
|
|
+ String canonicalDirPath = dir.getCanonicalPath();
|
|
+ String canonicalFilePath = f.getCanonicalPath();
|
|
+
|
|
+ if ( !canonicalFilePath.startsWith( canonicalDirPath + File.separator )
|
|
+ && !canonicalFilePath.equals( canonicalDirPath ) )
|
|
+ {
|
|
+ throw new IOException( "Entry '" + entryName + "' outside the target directory." );
|
|
+ }
|
|
+ }
|
|
+ catch ( IOException e )
|
|
{
|
|
- throw new IOException( "Entry '" + entryName + "' outside the target directory." );
|
|
+ throw new IOException( "Failed to verify entry path for '" + entryName + "'", e );
|
|
}
|
|
|
|
try
|