fix: experimental fix to prevent path traversal with copied folders

This commit is contained in:
Connor Tumbleson 2019-05-07 18:05:51 -04:00 committed by Connor Tumbleson
parent 5aa3cf9728
commit 47854ec757
No known key found for this signature in database
GPG Key ID: C3CC0A201EC7DA75

View File

@ -81,7 +81,8 @@ public class DirUtil {
if (fileName.equals("res") && !in.containsFile(fileName)) {
return;
}
File outFile = new File(out, fileName);
String cleanedFilename = BrutIO.sanitizeUnknownFile(out, fileName);
File outFile = new File(out, cleanedFilename);
outFile.getParentFile().mkdirs();
BrutIO.copyAndClose(in.getFileInput(fileName),
new FileOutputStream(outFile));