-
Notifications
You must be signed in to change notification settings - Fork 102
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
zip条目覆盖 #32
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
您好:
在ZipFileUtils.java文件中的uozip2Dir()方法是为了将zip包解压到指定文件夹中,但由于解压过程中没有对条目名做校验,导致攻击者可能通过构造带有../的zip文件,解压时会覆盖指定目录之外的敏感文件
修复方法:
The text was updated successfully, but these errors were encountered: