mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-07-30 07:18:37 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/patch'

Browse Source
This commit is contained in:
Ryan Kurtz
2026-06-08 06:32:23 -04:00
parent cc262c3eb3 00abcc4821
commit 430465776d
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java
View File

@@ -115,8 +115,7 @@ public class AndroidProjectCreator {
}
private void processListing(File outputDirectory, GFileSystem fs, List<GFile> listing,
TaskMonitor monitor)
throws IOException, CancelledException {
TaskMonitor monitor) throws IOException, CancelledException {
for (GFile child : listing) {
String childName = child.getName();
@@ -131,6 +130,10 @@ public class AndroidProjectCreator {
continue;
}
File subDir = new File(outputDirectory, childName);
if (!FileUtilities.isPathContainedWithin(outputDirectory, subDir)) {
Msg.error(this, "Skipping directory with path traversal: " + childName);
continue;
}
FileUtilities.checkedMkdir(subDir);
processListing(subDir, fs, child.getListing(), monitor);
continue;
@@ -220,6 +223,9 @@ public class AndroidProjectCreator {
try (InputStream is = inputFile.getInputStream()) {
FileUtilities.checkedMkdirs(outputDirectory);
File destFile = new File(outputDirectory, outputName);
if (!FileUtilities.isPathContainedWithin(outputDirectory, destFile)) {
throw new IOException("Path traversal detected in entry name: " + outputName);
}
monitor.setMessage("Copying [" + inputFile.getName() + "] to Eclipse project...");
FileUtilities.copyStreamToFile(is, destFile, false, monitor);