Ignore file entries containing '..' in the APK file to fix #1498

Zip/APK files can legally contain entries that point to the parent directory of the one in which the .zip is located.
Usually, unzip implementations ignore them by default, and we‘ll do the same.
This commit is contained in:
Marvin Killing 2017-05-09 21:54:53 +02:00
parent f979f202c7
commit 693f592b13

View File

@ -136,7 +136,8 @@ public class ZipRODirectory extends AbstractDirectory {
subname = subname.substring(0, pos);
}
if (! mDirs.containsKey(subname)) {
boolean pointsToParentDirectory = (subname.equals("..") && prefixLen == 0);
if (! mDirs.containsKey(subname) && ! pointsToParentDirectory) {
AbstractDirectory dir = new ZipRODirectory(getZipFile(), getPath() + subname + separator);
mDirs.put(subname, dir);
}