Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zip_slip #358

Open
QiAnXinCodeSafe opened this issue May 17, 2019 · 0 comments
Open

zip_slip #358

QiAnXinCodeSafe opened this issue May 17, 2019 · 0 comments

Comments

@QiAnXinCodeSafe
Copy link

QiAnXinCodeSafe commented May 17, 2019 •
edited
Loading

  1. demo问题的issue格式： [demo]:title
    ZipUtils.java中提供了unzip方法对压缩文件进行解压，但是由于没有校验压缩文件的条目名，当解压又攻击者恶意构造的压缩文件时(条目名中带有../)，会覆盖初始文件夹之外的铭感文件
    图片

  2. 容器功能接入或者如何使用的答疑：[use]:title

  3. 提新需求的格式：[feature]:title
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@QiAnXinCodeSafe