diff --git a/plugins/java-decompiler/engine/src/org/jetbrains/java/decompiler/struct/StructContext.java b/plugins/java-decompiler/engine/src/org/jetbrains/java/decompiler/struct/StructContext.java index fb66699281f03..1ef898c0428fa 100644 --- a/plugins/java-decompiler/engine/src/org/jetbrains/java/decompiler/struct/StructContext.java +++ b/plugins/java-decompiler/engine/src/org/jetbrains/java/decompiler/struct/StructContext.java @@ -139,8 +139,8 @@ private void addArchive(String path, File file, int type, boolean isOwn) throws } String name = entry.getName(); - File test = new File(file.getAbsolutePath(), name); - if (!test.getCanonicalPath().startsWith(file.getCanonicalPath() + File.separator)) { // check for zip slip exploit + String normalizedName = name.replace('\\', '/'); + if (normalizedName.startsWith("/") || normalizedName.startsWith(".." + "/") || normalizedName.contains("/" + ".." + "/")) { // check for zip slip exploit throw new RuntimeException("Zip entry '" + entry.getName() + "' tries to escape target directory"); }