Prevent malicious directory/file work with unknown files

brut.apktool/apktool-lib/src/main/java/brut/androlib/Androlib.java

@@ -617,7 +617,7 @@ public class Androlib {
             ) {
                 copyExistingFiles(inputFile, actualOutput);
                 copyUnknownFiles(appDir, actualOutput, files);
-            } catch (IOException ex) {
+            } catch (IOException | BrutException ex) {
                 throw new AndrolibException(ex);
             }
 
@@ -646,12 +646,12 @@ public class Androlib {
     }
 
     private void copyUnknownFiles(File appDir, ZipOutputStream outputFile, Map<String, String> files)
-            throws IOException {
+            throws BrutException, IOException {
         File unknownFileDir = new File(appDir, UNK_DIRNAME);
 
         // loop through unknown files
         for (Map.Entry<String,String> unknownFileInfo : files.entrySet()) {
-            File inputFile = new File(unknownFileDir, unknownFileInfo.getKey());
+            File inputFile = new File(unknownFileDir, BrutIO.sanitizeUnknownFile(unknownFileDir, unknownFileInfo.getKey()));
             if (inputFile.isDirectory()) {
                 continue;
             }

brut.apktool/apktool-lib/src/test/java/brut/androlib/UnknownDirectoryTraversalTest.java

@@ -0,0 +1,77 @@
+/**
+ *  Copyright 2014 Ryszard Wiśniewski <brut.alll@gmail.com>
+ *  Copyright 2016 Connor Tumbleson <connor.tumbleson@gmail.com>
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package brut.androlib;
+
+import brut.common.BrutException;
+import brut.common.InvalidUnknownFileException;
+import brut.common.RootUnknownFileException;
+import brut.common.TraversalUnknownFileException;
+import brut.directory.ExtFile;
+import brut.util.BrutIO;
+import brut.util.OS;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.io.File;
+import java.io.IOException;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * @author Connor Tumbleson <connor.tumbleson@gmail.com>
+ */
+public class UnknownDirectoryTraversalTest {
+
+    @BeforeClass
+    public static void beforeClass() throws Exception {
+        sTmpDir = new ExtFile(OS.createTempDirectory());
+        TestUtils.copyResourceDir(UnknownDirectoryTraversalTest.class, "brut/apktool/traversal", sTmpDir);
+    }
+
+    @Test
+    public void validFileTest() throws IOException, BrutException {
+        String validFilename = BrutIO.sanitizeUnknownFile(sTmpDir, "file");
+        assertEquals(validFilename, "file");
+
+        File validFile = new File(sTmpDir, validFilename);
+        assertTrue(validFile.isFile());
+    }
+
+    @Test(expected = TraversalUnknownFileException.class)
+    public void invalidBackwardFileTest() throws IOException, BrutException {
+        BrutIO.sanitizeUnknownFile(sTmpDir, "../file");
+    }
+
+    @Test(expected = RootUnknownFileException.class)
+    public void invalidRootFileTest() throws IOException, BrutException {
+        BrutIO.sanitizeUnknownFile(sTmpDir, "/file");
+    }
+
+    @Test(expected = InvalidUnknownFileException.class)
+    public void noFilePassedTest() throws IOException, BrutException {
+        BrutIO.sanitizeUnknownFile(sTmpDir, "");
+    }
+
+    @Test
+    public void validDirectoryFileTest() throws IOException, BrutException {
+        String validFilename = BrutIO.sanitizeUnknownFile(sTmpDir, "dir" + File.separator + "file");
+        assertEquals("dir" + File.separator + "file", validFilename);
+    }
+
+    public static File sTmpDir;
+}

brut.apktool/apktool-lib/src/test/resources/brut/apktool/traversal/file

@@ -0,0 +1 @@
+file