safer natural earth unzip

onthegomap · Mar 3, 2024 · fa7af07 · fa7af07
1 parent 40e64a2
commit fa7af07
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/planetiler-core/src/main/java/com/onthegomap/planetiler/reader/NaturalEarthReader.java b/planetiler-core/src/main/java/com/onthegomap/planetiler/reader/NaturalEarthReader.java
@@ -15,7 +15,6 @@
 import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.ResultSet;
@@ -101,10 +100,14 @@ private Connection open(Path path, Path unzippedDir) throws IOException, SQLExce
           .findFirst()
           .orElseThrow(() -> new IllegalArgumentException("No .sqlite file found inside " + path));
         extracted = unzippedDir.resolve(URLEncoder.encode(zipEntry.toString(), StandardCharsets.UTF_8));
+        if (!extracted.startsWith(unzippedDir)) {
+          throw new IllegalArgumentException(
+            "Zip file tried to extract child outside of folder: " + zipEntry.getFileName());
+        }
         FileUtils.createParentDirectories(extracted);
         if (!keepUnzipped || FileUtils.isNewer(path, extracted)) {
           LOGGER.info("unzipping {} to {}", path.toAbsolutePath(), extracted);
-          Files.copy(Files.newInputStream(zipEntry), extracted, StandardCopyOption.REPLACE_EXISTING);
+          FileUtils.safeCopy(Files.newInputStream(zipEntry), extracted);
         }
         if (!keepUnzipped) {
           extracted.toFile().deleteOnExit();

diff --git a/planetiler-core/src/main/java/com/onthegomap/planetiler/util/FileUtils.java b/planetiler-core/src/main/java/com/onthegomap/planetiler/util/FileUtils.java
@@ -268,7 +268,7 @@ public static void unzipResource(String resource, Path dest) {
    * @throws UncheckedIOException if an IO exception occurs
    */
   public static void safeCopy(InputStream inputStream, Path destPath) {
-    try (var outputStream = Files.newOutputStream(destPath, StandardOpenOption.CREATE, WRITE)) {
+    try (var outputStream = Files.newOutputStream(destPath, StandardOpenOption.CREATE, StandardOpenOption.WRITE)) {
       int totalSize = 0;
 
       int nBytes;