diff --git a/android/app/src/main/java/net/minetest/minetest/UnzipService.java b/android/app/src/main/java/net/minetest/minetest/UnzipService.java index b75bc0c..d734123 100644 --- a/android/app/src/main/java/net/minetest/minetest/UnzipService.java +++ b/android/app/src/main/java/net/minetest/minetest/UnzipService.java @@ -168,20 +168,16 @@ public class UnzipService extends IntentService { continue; } publishProgress(notificationBuilder, R.string.loading, 100 * ++per / size); - // Zip Path Traversal Vulnerability fix: https://support.google.com/faqs/answer/9294009 - + + // "Zip Path Traversal Vulnerability" fixed according to this article: https://support.google.com/faqs/answer/9294009 File new_file = new File(userDataDirectory, ze.getName()); String canonicalPath = new_file.getCanonicalPath(); - - // check if canonical path is inside the target directory - //if (!canonicalPath.startsWith(userDataDirectory)) { if (!canonicalPath.startsWith(String.valueOf(userDataDirectory))) { throw new IOException("Unzipping failed due to security issue!"); } - //try (OutputStream outputStream = new FileOutputStream(new File(userDataDirectory, ze.getName()))) { try (OutputStream outputStream = new FileOutputStream(new_file)) { while ((readLen = zipInputStream.read(readBuffer)) != -1) { outputStream.write(readBuffer, 0, readLen);