(sis) branch geoapi-4.0 updated: Ensure that JavaFX cannot be unzipped outside its destination directory.

[desruisseaux]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch geoapi-4.0
in repository https://gitbox.apache.org/repos/asf/sis.git


The following commit(s) were added to refs/heads/geoapi-4.0 by this push:
     new 551217596f Ensure that JavaFX cannot be unzipped outside its 
destination directory.
551217596f is described below

commit 551217596fb5db0c892877af6955664d3211c8dd
Author: Martin Desruisseaux <martin.desruisse...@geomatys.com>
AuthorDate: Fri Aug 21 11:33:48 2026 +0200

    Ensure that JavaFX cannot be unzipped outside its destination directory.
---
 .../org.apache.sis.gui/main/org/apache/sis/gui/setup/Inflater.java  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git 
a/optional/src/org.apache.sis.gui/main/org/apache/sis/gui/setup/Inflater.java 
b/optional/src/org.apache.sis.gui/main/org/apache/sis/gui/setup/Inflater.java
index eb9a456cee..5f7c122846 100644
--- 
a/optional/src/org.apache.sis.gui/main/org/apache/sis/gui/setup/Inflater.java
+++ 
b/optional/src/org.apache.sis.gui/main/org/apache/sis/gui/setup/Inflater.java
@@ -97,9 +97,10 @@ final class Inflater implements Runnable {
      */
     private void doInBackground() throws Exception {
         destination = wizard.javafxFinder.getDestinationDirectory();
+        final String filePrefix = destination.getCanonicalPath() + 
File.separator;
         final JProgressBar progressBar = wizard.inflateProgress;
         final byte[] buffer = new byte[65536];
-        try (ZipFile zip = new ZipFile(source)) {
+        try (final var zip = new ZipFile(source)) {
             final int size = zip.size();
             EventQueue.invokeAndWait(() -> progressBar.setMaximum(size));
             final Enumeration<? extends ZipEntry> entries = zip.entries();
@@ -107,6 +108,9 @@ final class Inflater implements Runnable {
             while (entries.hasMoreElements()) {
                 final ZipEntry entry = entries.nextElement();
                 final File file = new File(destination, entry.getName());
+                if (!file.getCanonicalPath().startsWith(filePrefix)) {
+                    throw new IOException("Entry outside of target directory: 
" + entry);
+                }
                 if (entry.isDirectory()) {
                     if (!file.isDirectory() && !file.mkdir()) {
                         throw new IOException("Directory cannot be created: " 
+ file);