diff --git a/core/java/src/net/i2p/util/FileUtil.java b/core/java/src/net/i2p/util/FileUtil.java index 535e3deee5995ac8a73f78dcd3aa01ee78d9b41e..eeca4416feba3bcd2a644d4e41b8de995e795c23 100644 --- a/core/java/src/net/i2p/util/FileUtil.java +++ b/core/java/src/net/i2p/util/FileUtil.java @@ -109,10 +109,14 @@ public class FileUtil { Enumeration<? extends ZipEntry> entries = zip.entries(); while (entries.hasMoreElements()) { ZipEntry entry = (ZipEntry)entries.nextElement(); - if (entry.getName().indexOf("..") != -1) { + if (entry.getName().contains("..")) { System.err.println("ERROR: Refusing to extract a zip entry with '..' in it [" + entry.getName() + "]"); return false; } + if (entry.getName().indexOf(0) >= 0) { + System.err.println("ERROR: Refusing to extract a zip entry with null in it [" + entry.getName() + "]"); + return false; + } File target = new File(targetDir, entry.getName()); File parent = target.getParentFile(); if ( (parent != null) && (!parent.exists()) ) {