ReVanced/Apktool
1
0
Fork 0
mirror of https://github.com/revanced/Apktool.git synced 2025-06-13 05:27:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent arbitrary file writes with malicious resource names. (#3484)

Browse Source 
* refactor: rename sanitize function

* fix: expose getDir

* fix: safe handling of untrusted resource names

 - fixes: GHSA-2hqv-2xv4-5h5w

* test: sample file for GHSA-2hqv-2xv4-5h5w

* refactor: avoid detection of absolute files for resource check

* chore: enable info mode on gradle

* test: skip test on windows

* chore: debug windows handling

* fix: normalize entry with file separators

* fix: normalize filepath after cleansing

* chore: Android paths are not OS specific

* refactor: use java.nio for path traversal checking

* chore: align path separator on Windows for Zip files

* chore: rework towards basic directory traversal

* chore: remove '--info' on build.yml
This commit is contained in:
Connor Tumbleson
2024-01-02 06:11:03 -05:00
committed by GitHub
parent e5c88ece1b
commit d348c43b24
10 changed files with 100 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
brut.j.util/src/main/java/brut/util/BrutIO.java
View File

@ -74,8 +74,8 @@ public class BrutIO {
return crc;
}
public static String sanitizeUnknownFile(final File directory, final String entry) throws IOException, BrutException {
if (entry.length() == 0) {
public static String sanitizeFilepath(final File directory, final String entry) throws IOException, BrutException {
if (entry.isEmpty()) {
throw new InvalidUnknownFileException("Invalid Unknown File");
}
@ -94,7 +94,14 @@ public class BrutIO {
return canonicalEntryPath.substring(canonicalDirPath.length());
}
public static String normalizePath(String path) {
public static boolean detectPossibleDirectoryTraversal(String entry) {
if (OSDetection.isWindows()) {
return entry.contains("..\\") || entry.contains("\\..");
}
return entry.contains("../") || entry.contains("/..");
}
public static String adaptSeparatorToUnix(String path) {
char separator = File.separatorChar;
if (separator != '/') {