From c54aa434757237e72a8564e5ccdef5e4633034bf Mon Sep 17 00:00:00 2001
From: Wasim Nabil <w.nabil@orangestudio.com>
Date: Thu, 11 Feb 2021 13:02:38 +0200
Subject: [PATCH] merge zip

https://github.com/MobileChromeApps/cordova-plugin-zip/pull/92
---
 src/android/Zip.java | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/android/Zip.java b/src/android/Zip.java
index 4b5de862..7afe3103 100644
--- a/src/android/Zip.java
+++ b/src/android/Zip.java
@@ -126,6 +126,13 @@ private void unzipSync(CordovaArgs args, CallbackContext callbackContext) {
                    dir.mkdirs();
                 } else {
                     File file = new File(outputDirectory + compressedName);
+                    String canonicalPath = file.getCanonicalPath();
+                    if (!canonicalPath.startsWith(outputDirectory)) {
+                        String errorMessage = "Zip traversal security error";
+                        callbackContext.error(errorMessage);
+                        Log.e(LOG_TAG, errorMessage);
+                        return;
+                    }
                     file.getParentFile().mkdirs();
                     if(file.exists() || file.createNewFile()){
                         Log.w("Zip", "extracting: " + file.getPath());