(ofbiz-framework) branch trunk updated: Improved: Always protect FileUtil.unzipFileToFolder against zip slip (OFBIZ-13633)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 8f46f1e119 Improved: Always protect FileUtil.unzipFileToFolder against 
zip slip (OFBIZ-13633)
8f46f1e119 is described below

commit 8f46f1e119e6c29da63eaece5d5107e406e60410
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sat Oct 3 10:01:33 2026 +0530

    Improved: Always protect FileUtil.unzipFileToFolder against zip slip 
(OFBIZ-13633)
    
    FileUtil.unzipFileToFolder() had a handleZipSlip parameter, and when it was 
false the entries were written without the check that FileUtil.newFile() 
applies. The parameter is removed, so the check is always applied. The only 
caller was a unit test, which is updated.
---
 .../main/java/org/apache/ofbiz/base/util/FileUtil.java   | 16 +++-------------
 .../org/apache/ofbiz/base/util/FileUtilTests.groovy      |  2 +-
 2 files changed, 4 insertions(+), 14 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
index 35aeffaa77..80d517a43a 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
@@ -418,10 +418,9 @@ public final class FileUtil {
      * Unzip file structure of the given zipFile to specified outputFolder
      * @param zipFile
      * @param outputFolder
-     * @param handleZipSlip if true FileUtil::newFile is used
-     * @throws IOException
+     * @throws IOException when an entry would be written outside of 
outputFolder, see {@link #newFile(String, ZipEntry)}
      */
-    public static boolean unzipFileToFolder(File zipFile, String outputFolder, 
boolean handleZipSlip) throws IOException {
+    public static boolean unzipFileToFolder(File zipFile, String outputFolder) 
throws IOException {
         byte[] buffer = new byte[8192];
 
         //create output directory if not exists
@@ -436,16 +435,7 @@ public final class FileUtil {
             ZipEntry ze = zis.getNextEntry();
 
             while (ze != null) {
-                File newFile = null;
-                if (handleZipSlip) {
-                    newFile = newFile(outputFolder, ze); // Prevents Zip slip 
vulnerability
-                    if (null == newFile) {
-                        zis.closeEntry();
-                        return false;
-                    }
-                } else {
-                    newFile = new File(outputFolder, ze.getName());
-                }
+                File newFile = newFile(outputFolder, ze); // Prevents Zip slip 
vulnerability
                 //create all non existing folders
                 //else you will hit FileNotFoundException for compressed folder
                 new File(newFile.getParent()).mkdirs();
diff --git 
a/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
 
b/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
index 4fb20b064e..36207a08f0 100644
--- 
a/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
+++ 
b/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
@@ -60,7 +60,7 @@ class FileUtilTests {
         }
 
         //validate unzip and compare the two files
-        FileUtil.unzipFileToFolder(readmeZipped, zipFilePath, false)
+        FileUtil.unzipFileToFolder(readmeZipped, zipFilePath)
 
         assert FileUtils.contentEquals(originalReadme, new File(zipFilePath, 
fileName))
     }