Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-25 00:01:50 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

GP-6885: Fixing potential path traversal in AndroidProjectCreator

Browse Source
This commit is contained in:
Ryan Kurtz
2026-06-05 07:44:02 -04:00
parent c0f584bf22
commit 299fb1cc8c
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java
+8 -2
View File
@@ -115,8 +115,7 @@ public class AndroidProjectCreator {
}
private void processListing(File outputDirectory, GFileSystem fs, List<GFile> listing,
TaskMonitor monitor)
throws IOException, CancelledException {
TaskMonitor monitor) throws IOException, CancelledException {
for (GFile child : listing) {
String childName = child.getName();
@@ -131,6 +130,10 @@ public class AndroidProjectCreator {
continue;
}
File subDir = new File(outputDirectory, childName);
if (!FileUtilities.isPathContainedWithin(outputDirectory, subDir)) {
Msg.error(this, "Skipping directory with path traversal: " + childName);
continue;
}
FileUtilities.checkedMkdir(subDir);
processListing(subDir, fs, child.getListing(), monitor);
continue;
@@ -220,6 +223,9 @@ public class AndroidProjectCreator {
try (InputStream is = inputFile.getInputStream()) {
FileUtilities.checkedMkdirs(outputDirectory);
File destFile = new File(outputDirectory, outputName);
if (!FileUtilities.isPathContainedWithin(outputDirectory, destFile)) {
throw new IOException("Path traversal detected in entry name: " + outputName);
}
monitor.setMessage("Copying [" + inputFile.getName() + "] to Eclipse project...");
FileUtilities.copyStreamToFile(is, destFile, false, monitor);