Skip to content

Commit a3855df

Browse files
committed
re-fix zip traversal vuln, path discrepancy
/data/data/foo vs /data/user/0/foo, as suggested by @jcperuffo in MobileChromeApps#92 (comment)
1 parent 1fe648b commit a3855df

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/android/Zip.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,8 @@ private void unzipSync(CordovaArgs args, CallbackContext callbackContext) {
127127
} else {
128128
File file = new File(outputDirectory + compressedName);
129129
String canonicalPath = file.getCanonicalPath();
130-
if (!canonicalPath.startsWith(outputDirectory)) {
130+
String absolutePath = file.getAbsolutePath();
131+
if (!canonicalPath.startsWith(outputDirectory) && !absolutePath.startsWith(outputDirectory)) {
131132
String errorMessage = "Zip traversal security error";
132133
callbackContext.error(errorMessage);
133134
Log.e(LOG_TAG, errorMessage);

0 commit comments

Comments
 (0)