[maven] branch MNG-6942 created (now ad713b4)

[rf...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rfscholte pushed a change to branch MNG-6942
in repository https://gitbox.apache.org/repos/asf/maven.git.


      at ad713b4  [MNG-6942] Arbitrary file write during archive extraction ("Zip Slip") in wrapper

This branch includes the following new commits:

     new ad713b4  [MNG-6942] Arbitrary file write during archive extraction ("Zip Slip") in wrapper

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[maven] 01/01: [MNG-6942] Arbitrary file write during archive extraction ("Zip Slip") in wrapper

[rf...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rfscholte pushed a commit to branch MNG-6942
in repository https://gitbox.apache.org/repos/asf/maven.git

commit ad713b4cff8f8772dbfe4ef52afc6e286c0baa40
Author: rfscholte <rf...@apache.org>
AuthorDate: Sat Jun 20 12:59:22 2020 +0200

    [MNG-6942] Arbitrary file write during archive extraction ("Zip Slip") in wrapper
---
 maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java b/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
index f763de3..3a0b46f 100644
--- a/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
+++ b/maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java
@@ -211,7 +211,7 @@ public class Installer
                     continue;
                 }
 
-                Path targetFile = dest.resolve( entry.getName() );
+                Path targetFile = dest.resolve( entry.getName() ).normalize();
 
                 // prevent Zip Slip
                 if ( targetFile.startsWith( dest ) )