From 2a29c45ce53311b4dccda6cd9d0dcfeaf7946283 Mon Sep 17 00:00:00 2001 From: Looki2000 Date: Mon, 27 Feb 2023 14:58:09 +0100 Subject: [PATCH] unzipservice code cleanup. does not affect code functionality --- .../src/main/java/net/minetest/minetest/UnzipService.java | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/android/app/src/main/java/net/minetest/minetest/UnzipService.java b/android/app/src/main/java/net/minetest/minetest/UnzipService.java index b75bc0c..d734123 100644 --- a/android/app/src/main/java/net/minetest/minetest/UnzipService.java +++ b/android/app/src/main/java/net/minetest/minetest/UnzipService.java @@ -168,20 +168,16 @@ public class UnzipService extends IntentService { continue; } publishProgress(notificationBuilder, R.string.loading, 100 * ++per / size); - // Zip Path Traversal Vulnerability fix: https://support.google.com/faqs/answer/9294009 - + + // "Zip Path Traversal Vulnerability" fixed according to this article: https://support.google.com/faqs/answer/9294009 File new_file = new File(userDataDirectory, ze.getName()); String canonicalPath = new_file.getCanonicalPath(); - - // check if canonical path is inside the target directory - //if (!canonicalPath.startsWith(userDataDirectory)) { if (!canonicalPath.startsWith(String.valueOf(userDataDirectory))) { throw new IOException("Unzipping failed due to security issue!"); } - //try (OutputStream outputStream = new FileOutputStream(new File(userDataDirectory, ze.getName()))) { try (OutputStream outputStream = new FileOutputStream(new_file)) { while ((readLen = zipInputStream.read(readBuffer)) != -1) { outputStream.write(readBuffer, 0, readLen);