fix: vulnerability issue

Cap-go · Nov 17, 2022 · 738904f · 738904f
1 parent 55159b8
commit 738904f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdater.java b/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdater.java
@@ -119,7 +119,7 @@ private String randomString(final int len) {
     }
 
     private File unzip(final String id, final File zipFile, final String dest) throws IOException {
-        final File targetDirectory = new File(this.documentsDir, dest);
+        final File targetDirectory = new File(this.documentsDir, Paths.get(dest).normalize().toString());
         final ZipInputStream zis = new ZipInputStream(new BufferedInputStream(new FileInputStream(zipFile)));
         try {
             int count;
@@ -132,7 +132,7 @@ private File unzip(final String id, final File zipFile, final String dest) throw
 
             ZipEntry entry;
             while ((entry = zis.getNextEntry()) != null) {
-                final File file = new File(targetDirectory, entry.getName());
+                final File file = new File(targetDirectory, Paths.get(entry.getName()).normalize().toString());
                 final String canonicalPath = file.getCanonicalPath();
                 final String canonicalDir = (new File(String.valueOf(targetDirectory))).getCanonicalPath();
                 final File dir = entry.isDirectory() ? file : file.getParentFile();