diff --git a/brut.apktool/apktool-lib/src/test/java/brut/androlib/ParentDirectoryTraversalTest.java b/brut.apktool/apktool-lib/src/test/java/brut/androlib/ParentDirectoryTraversalTest.java new file mode 100644 index 00000000..1361c570 --- /dev/null +++ b/brut.apktool/apktool-lib/src/test/java/brut/androlib/ParentDirectoryTraversalTest.java @@ -0,0 +1,58 @@ +/** + * Copyright 2014 Ryszard Wiśniewski + * Copyright 2014 Connor Tumbleson + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package brut.androlib; + +import brut.common.BrutException; +import brut.directory.ExtFile; +import brut.util.OS; +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.Test; + +import java.io.File; +import java.io.IOException; + +public class ParentDirectoryTraversalTest { + + @BeforeClass + public static void beforeClass() throws Exception { + TestUtils.cleanFrameworkFile(); + sTmpDir = new ExtFile(OS.createTempDirectory()); + TestUtils.copyResourceDir(ParentDirectoryTraversalTest.class, "brut/apktool/issue1498/", sTmpDir); + } + + @AfterClass + public static void afterClass() throws BrutException { + OS.rmdir(sTmpDir); + } + + @Test + public void checkIfDrawableFileDecodesProperly() throws BrutException, IOException { + String apk = "issue1498.apk"; + + // decode issue1498.apk + ApkDecoder apkDecoder = new ApkDecoder(new File(sTmpDir + File.separator + apk)); + apkDecoder.setDecodeResources(ApkDecoder.DECODE_RESOURCES_NONE); + + apkDecoder.setOutDir(new File(sTmpDir + File.separator + apk + ".out")); + + // this should not raise an exception: + apkDecoder.decode(); + } + + private static ExtFile sTmpDir; +} diff --git a/brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1498/issue1498.apk b/brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1498/issue1498.apk new file mode 100644 index 00000000..4ab1a13f Binary files /dev/null and b/brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1498/issue1498.apk differ diff --git a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java index a400ce34..c16dac31 100644 --- a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java +++ b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java @@ -136,7 +136,8 @@ public class ZipRODirectory extends AbstractDirectory { subname = subname.substring(0, pos); } - if (! mDirs.containsKey(subname)) { + boolean pointsToParentDirectory = (subname.equals("..") && prefixLen == 0); + if (! mDirs.containsKey(subname) && ! pointsToParentDirectory) { AbstractDirectory dir = new ZipRODirectory(getZipFile(), getPath() + subname + separator); mDirs.put(subname, dir); }