Merge branch 'playtestcloud-issue-1498'

brut.apktool/apktool-lib/src/test/java/brut/androlib/ParentDirectoryTraversalTest.java

@@ -0,0 +1,58 @@
+/**
+ *  Copyright 2014 Ryszard Wiśniewski <brut.alll@gmail.com>
+ *  Copyright 2014 Connor Tumbleson <connor.tumbleson@gmail.com>
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package brut.androlib;
+
+import brut.common.BrutException;
+import brut.directory.ExtFile;
+import brut.util.OS;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.io.File;
+import java.io.IOException;
+
+public class ParentDirectoryTraversalTest {
+
+    @BeforeClass
+    public static void beforeClass() throws Exception {
+        TestUtils.cleanFrameworkFile();
+        sTmpDir = new ExtFile(OS.createTempDirectory());
+        TestUtils.copyResourceDir(ParentDirectoryTraversalTest.class, "brut/apktool/issue1498/", sTmpDir);
+    }
+
+    @AfterClass
+    public static void afterClass() throws BrutException {
+        OS.rmdir(sTmpDir);
+    }
+
+    @Test
+    public void checkIfDrawableFileDecodesProperly() throws BrutException, IOException {
+        String apk = "issue1498.apk";
+
+        // decode issue1498.apk
+        ApkDecoder apkDecoder = new ApkDecoder(new File(sTmpDir + File.separator + apk));
+        apkDecoder.setDecodeResources(ApkDecoder.DECODE_RESOURCES_NONE);
+
+        apkDecoder.setOutDir(new File(sTmpDir + File.separator + apk + ".out"));
+
+        // this should not raise an exception:
+        apkDecoder.decode();
+    }
+
+    private static ExtFile sTmpDir;
+}

brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java

@@ -136,7 +136,8 @@ public class ZipRODirectory extends AbstractDirectory {
                 subname = subname.substring(0, pos);
             }
             
-            if (! mDirs.containsKey(subname)) {
+            boolean pointsToParentDirectory = (subname.equals("..") && prefixLen == 0);
+            if (! mDirs.containsKey(subname) && ! pointsToParentDirectory) {
                 AbstractDirectory dir = new ZipRODirectory(getZipFile(), getPath() + subname + separator);
                 mDirs.put(subname, dir);                
             }