From b8856fc63d48c9a927a816be6fb3694ea41f8ca9 Mon Sep 17 00:00:00 2001
From: Bitmap <mohdzaki407@gmail.com>
Date: Sun, 10 Mar 2024 17:54:57 +0530
Subject: [PATCH] Fixed code scanning alert - Arbitrary file access during
 archive extraction ("Zip Slip") #7

---
 src/jvmMain/kotlin/utils/FileUtils.kt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/jvmMain/kotlin/utils/FileUtils.kt b/src/jvmMain/kotlin/utils/FileUtils.kt
index 8d81876..e3fd1b0 100644
--- a/src/jvmMain/kotlin/utils/FileUtils.kt
+++ b/src/jvmMain/kotlin/utils/FileUtils.kt
@@ -5,6 +5,7 @@ import java.io.File
 import java.io.IOException
 import java.io.InputStream
 import java.io.FileOutputStream
+import java.nio.file.Paths
 import java.util.zip.ZipFile
 
 object FileUtils {
@@ -44,7 +45,8 @@ object FileUtils {
                 if (entry.name == skipFile) return@forEach
 
                 zip.getInputStream(entry).use { input ->
-                    val filePath = destDirectory + File.separator + entry.name
+                    val safeEntryName = Paths.get(entry.name).normalize().toString()
+                    val filePath = destDirectory + File.separator + safeEntryName
 
                     if (!entry.isDirectory) {
                         // if the entry is a file, extracts it