diff --git a/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java b/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java index 901af7296..e0bbe8ae7 100644 --- a/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java +++ b/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java @@ -104,13 +104,14 @@ public void extract(String archive, String destinationDirectory) throws ArchiveE tarIn = new TarArchiveInputStream(new GzipCompressorInputStream(fis)); TarArchiveEntry tarEntry = tarIn.getNextTarEntry(); + String canonicalDestinationDirectory = new File(destinationDirectory).getCanonicalPath(); while (tarEntry != null) { // Create a file for this tarEntry final File destPath = new File(destinationDirectory + File.separator + tarEntry.getName()); prepDestination(destPath, tarEntry.isDirectory()); - if (!destPath.getCanonicalPath().startsWith(destinationDirectory)) { + if (!destPath.getCanonicalPath().startsWith(canonicalDestinationDirectory)) { throw new IOException( - "Expanding " + tarEntry.getName() + " would create file outside of " + destinationDirectory + "Expanding " + tarEntry.getName() + " would create file outside of " + canonicalDestinationDirectory ); } if (!tarEntry.isDirectory()) {