diff --git a/src/org/jetbrains/java/decompiler/struct/StructContext.java b/src/org/jetbrains/java/decompiler/struct/StructContext.java index fb6669928..1b2152009 100644 --- a/src/org/jetbrains/java/decompiler/struct/StructContext.java +++ b/src/org/jetbrains/java/decompiler/struct/StructContext.java @@ -139,8 +139,8 @@ private void addArchive(String path, File file, int type, boolean isOwn) throws } String name = entry.getName(); - File test = new File(file.getAbsolutePath(), name); - if (!test.getCanonicalPath().startsWith(file.getCanonicalPath() + File.separator)) { // check for zip slip exploit + String normalizedName = name.replace('\\', '/'); + if (normalizedName.startsWith("/") || normalizedName.startsWith("../") || normalizedName.contains("/../")) { throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory"); }