(ofbiz-framework) branch release24.09 updated: Improved: Always protect FileUtil.unzipFileToFolder against zip slip (OFBIZ-13633)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 75b68a58f6 Improved: Always protect FileUtil.unzipFileToFolder against 
zip slip (OFBIZ-13633)
75b68a58f6 is described below

commit 75b68a58f6ff8f47329dd2bb61d8f4a52939c151
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sat Oct 3 10:01:33 2026 +0530

    Improved: Always protect FileUtil.unzipFileToFolder against zip slip 
(OFBIZ-13633)
    
    FileUtil.unzipFileToFolder() had a handleZipSlip parameter, and when it was 
false the entries were written without the check that FileUtil.newFile() 
applies. The parameter is removed, so the check is always applied. The only 
caller was a unit test, which is updated.
---
 .../main/java/org/apache/ofbiz/base/util/FileUtil.java  | 17 +++--------------
 .../org/apache/ofbiz/base/util/FileUtilTests.groovy     |  2 +-
 2 files changed, 4 insertions(+), 15 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
index 774ae88778..216254e5d9 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/FileUtil.java
@@ -419,10 +419,9 @@ public final class FileUtil {
      * Unzip file structure of the given zipFile to specified outputFolder
      * @param zipFile
      * @param outputFolder
-     * @param handleZipSlip if true FileUtil::newFile is used
-     * @throws IOException
+     * @throws IOException when an entry would be written outside of 
outputFolder, see {@link #newFile(String, ZipEntry)}
      */
-    public static boolean unzipFileToFolder(File zipFile, String outputFolder, 
boolean handleZipSlip) throws IOException {
+    public static boolean unzipFileToFolder(File zipFile, String outputFolder) 
throws IOException {
         byte[] buffer = new byte[8192];
 
         //create output directory if not exists
@@ -437,17 +436,7 @@ public final class FileUtil {
         ZipEntry ze = zis.getNextEntry();
 
         while (ze != null) {
-            File newFile = null;
-            if (handleZipSlip) {
-                newFile = newFile(outputFolder, ze); // Prevents Zip slip 
vulnerability
-                if (null == newFile) {
-                    zis.closeEntry();
-                    zis.close();
-                    return false;
-                }
-            } else {
-                newFile = new File(outputFolder, ze.getName());
-            }
+            File newFile = newFile(outputFolder, ze); // Prevents Zip slip 
vulnerability
             //create all non existing folders
             //else you will hit FileNotFoundException for compressed folder
             new File(newFile.getParent()).mkdirs();
diff --git 
a/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
 
b/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
index 166f1ddea5..b30adb29f6 100644
--- 
a/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
+++ 
b/framework/base/src/test/groovy/org/apache/ofbiz/base/util/FileUtilTests.groovy
@@ -60,7 +60,7 @@ class FileUtilTests {
         }
 
         //validate unzip and compare the two files
-        FileUtil.unzipFileToFolder(readmeZipped, zipFilePath, false)
+        FileUtil.unzipFileToFolder(readmeZipped, zipFilePath)
 
         assert FileUtils.contentEquals(originalReadme, new File(zipFilePath, 
fileName))
     }