You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "tanvir-ux (via GitHub)" <gi...@apache.org> on 2026/08/28 07:41:02 UTC

[PR] [COMPRESS-725] Use ArchiveEntry.resolveIn in ArchiveStreamFactory decompress example [commons-compress]

tanvir-ux opened a new pull request, #810:
URL: https://github.com/apache/commons-compress/pull/810

   ## Summary
   Fixes [COMPRESS-725](https://issues.apache.org/jira/browse/COMPRESS-725).
   
   The class-level \"Decompressing a ZIP-File\" example in `ArchiveStreamFactory` used:
   
   ```java
   Files.newOutputStream(dir.toPath().resolve(entry.getName()))
   ```
   
   That pattern is vulnerable to Zip Slip if copied into application code. Commons Compress already provides `ArchiveEntry.resolveIn(Path)` (since 1.26.0) as the safe extraction helper used by `Expander`.
   
   This PR updates the example to:
   
   ```java
   Files.newOutputStream(entry.resolveIn(dir.toPath()))
   ```
   
   Documentation-only; no behavioral change.
   
   ## Testing
   - Doc-only change in class Javadoc.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [COMPRESS-725] Use ArchiveEntry.resolveIn in ArchiveStreamFactory decompress example [commons-compress]

Posted by "uros-b (via GitHub)" <gi...@apache.org>.
uros-b commented on PR #810:
URL: https://github.com/apache/commons-compress/pull/810#issuecomment-5464995584

   Good catch @tanvir-ux!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [COMPRESS-725] Use ArchiveEntry.resolveIn in ArchiveStreamFactory decompress example [commons-compress]

Posted by "tanvir-ux (via GitHub)" <gi...@apache.org>.
tanvir-ux commented on PR #810:
URL: https://github.com/apache/commons-compress/pull/810#issuecomment-5465381978

   Thanks @uros-b 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org