From 299fb1cc8ca031a556d6d24defbdf0d6437102ad Mon Sep 17 00:00:00 2001 From: Ryan Kurtz Date: Fri, 5 Jun 2026 07:44:02 -0400 Subject: [PATCH] GP-6885: Fixing potential path traversal in AndroidProjectCreator --- .../ghidra/file/eclipse/AndroidProjectCreator.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java b/Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java index 19249412a9..b0b34315b0 100644 --- a/Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java +++ b/Ghidra/Features/FileFormats/src/main/java/ghidra/file/eclipse/AndroidProjectCreator.java @@ -115,8 +115,7 @@ public class AndroidProjectCreator { } private void processListing(File outputDirectory, GFileSystem fs, List listing, - TaskMonitor monitor) - throws IOException, CancelledException { + TaskMonitor monitor) throws IOException, CancelledException { for (GFile child : listing) { String childName = child.getName(); @@ -131,6 +130,10 @@ public class AndroidProjectCreator { continue; } File subDir = new File(outputDirectory, childName); + if (!FileUtilities.isPathContainedWithin(outputDirectory, subDir)) { + Msg.error(this, "Skipping directory with path traversal: " + childName); + continue; + } FileUtilities.checkedMkdir(subDir); processListing(subDir, fs, child.getListing(), monitor); continue; @@ -220,6 +223,9 @@ public class AndroidProjectCreator { try (InputStream is = inputFile.getInputStream()) { FileUtilities.checkedMkdirs(outputDirectory); File destFile = new File(outputDirectory, outputName); + if (!FileUtilities.isPathContainedWithin(outputDirectory, destFile)) { + throw new IOException("Path traversal detected in entry name: " + outputName); + } monitor.setMessage("Copying [" + inputFile.getName() + "] to Eclipse project..."); FileUtilities.copyStreamToFile(is, destFile, false, monitor);