From 24b376b6b041b0107270b1df5e2ecc3475bf265a Mon Sep 17 00:00:00 2001 From: philcali Date: Fri, 12 Nov 2021 10:55:52 -0500 Subject: [PATCH] fix: use canoncial for staging and content --- .../greengrass/testing/modules/GreengrassContextModule.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/aws-greengrass-testing-features/aws-greengrass-testing-features-api/src/main/java/com/aws/greengrass/testing/modules/GreengrassContextModule.java b/aws-greengrass-testing-features/aws-greengrass-testing-features-api/src/main/java/com/aws/greengrass/testing/modules/GreengrassContextModule.java index e953fbcd..b95d1399 100644 --- a/aws-greengrass-testing-features/aws-greengrass-testing-features-api/src/main/java/com/aws/greengrass/testing/modules/GreengrassContextModule.java +++ b/aws-greengrass-testing-features/aws-greengrass-testing-features-api/src/main/java/com/aws/greengrass/testing/modules/GreengrassContextModule.java @@ -47,9 +47,11 @@ static void extractZip(ObjectMapper mapper, Path archivePath, Path stagingPath) ZipEntry entry = zipStream.getNextEntry(); while (Objects.nonNull(entry)) { final Path contentPath = stagingPath.resolve(entry.getName()); - if (!contentPath.toFile().getAbsolutePath().startsWith(stagingPath.toAbsolutePath().toString())) { + final String contentCanonical = contentPath.toFile().getCanonicalPath(); + final String stagingCanonical = stagingPath.toFile().getCanonicalPath(); + if (!contentCanonical.startsWith(stagingCanonical)) { LOGGER.warn("Archive attempted to write {} outside of {}, skipping", - contentPath.toFile().getAbsolutePath(), stagingPath.toAbsolutePath()); + contentCanonical, stagingCanonical); entry = zipStream.getNextEntry(); continue; }