Skip to content

Commit f6d45b0

Browse files
sjmaplesjmaple
committed
Add ZipSlip exploit
1 parent 231c2c9 commit f6d45b0

File tree

8 files changed

+84
-35
lines changed

8 files changed

+84
-35
lines changed

‎exploits/zip-slip.zip

-87 Bytes
Binary file not shown.

‎todolist-core/src/main/java/io/github/todolist/core/domain/Todo.java

+53-3
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,26 @@
2424

2525
package io.github.todolist.core.domain;
2626

27-
import javax.persistence.*;
27+
import java.io.BufferedReader;
28+
import java.io.BufferedWriter;
29+
import java.io.File;
30+
import java.io.FileWriter;
31+
import java.io.InputStreamReader;
2832
import java.io.Serializable;
33+
import java.nio.file.Path;
2934
import java.util.Date;
3035

36+
import javax.persistence.Column;
37+
import javax.persistence.Entity;
38+
import javax.persistence.EnumType;
39+
import javax.persistence.Enumerated;
40+
import javax.persistence.GeneratedValue;
41+
import javax.persistence.Id;
42+
import javax.persistence.NamedQueries;
43+
import javax.persistence.NamedQuery;
44+
import javax.persistence.Temporal;
45+
import javax.persistence.TemporalType;
46+
3147
/**
3248
* Todo entity.
3349
*
@@ -40,7 +56,9 @@
4056
@NamedQuery(name = "findTodosByTitle", query = "SELECT t FROM Todo t where t.userId = ?1 and upper(t.title) like ?2 order by t.dueDate")
4157
})
4258
public class Todo implements Serializable {
43-
59+
60+
// If the JAVA_HOME isn't set, use the Heroku Java location
61+
static final String NATIVE2ASCII = System.getProperty("JAVA_HOME", "./.jdk") + File.separator + "bin" + File.separator + "native2ascii";
4462
@Id
4563
@GeneratedValue
4664
private long id;
@@ -64,12 +82,44 @@ public Todo() {
6482

6583
public Todo(long userId, String title, boolean done, Priority priority, Date dueDate) {
6684
this.userId = userId;
85+
86+
if (title != null)
87+
title = native2ascii(title);
88+
6789
this.title = title;
6890
this.done = done;
6991
this.priority = priority;
7092
this.dueDate = dueDate;
7193
}
7294

95+
private static BufferedReader getOutput(Process p) {
96+
return new BufferedReader(new InputStreamReader(p.getInputStream()));
97+
}
98+
99+
private String native2ascii(String title) {
100+
System.out.println("Running: " + NATIVE2ASCII);
101+
try {
102+
103+
BufferedWriter writer = new BufferedWriter(new FileWriter("title.txt"));
104+
writer.write(title);
105+
writer.close();
106+
Process p = Runtime.getRuntime().exec(NATIVE2ASCII + " title.txt");
107+
BufferedReader output = getOutput(p);
108+
String line = "";
109+
110+
while ((line = output.readLine()) != null) {
111+
if(!title.equals(line))
112+
System.out.println("Found non-ascii title. Converted from '" + title + "' to '" + line + "'");
113+
title = line;
114+
}
115+
116+
} catch (Exception e) {
117+
// if an error occurs, send back the original title
118+
e.printStackTrace();
119+
}
120+
return title;
121+
}
122+
73123
public long getId() {
74124
return id;
75125
}
@@ -87,7 +137,7 @@ public String getTitle() {
87137
}
88138

89139
public void setTitle(String title) {
90-
this.title = title;
140+
this.title = native2ascii(title);
91141
}
92142

93143
public boolean isDone() {

‎todolist-web-common/src/main/java/io/github/benas/todolist/web/common/tags/HighlightTag.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,16 @@
2424

2525
package io.github.benas.todolist.web.common.tags;
2626

27-
import javax.servlet.jsp.JspException;
28-
import javax.servlet.jsp.JspWriter;
29-
import javax.servlet.jsp.tagext.SimpleTagSupport;
27+
import java.io.File;
3028
import java.io.IOException;
3129
import java.io.StringWriter;
3230
import java.util.regex.Matcher;
3331
import java.util.regex.Pattern;
3432

33+
import javax.servlet.jsp.JspException;
34+
import javax.servlet.jsp.JspWriter;
35+
import javax.servlet.jsp.tagext.SimpleTagSupport;
36+
3537
/**
3638
* Utility tag to highlight text patterns with css style.
3739
*
@@ -63,7 +65,6 @@ public void doTag() throws JspException, IOException {
6365
getJspBody().invoke(stringWriter);
6466
String highlightedValue = doHighlight(stringWriter.toString());
6567
out.print(highlightedValue);
66-
6768
}
6869

6970
/**

‎todolist-web-struts/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@
7979
<dependency>
8080
<groupId>org.zeroturnaround</groupId>
8181
<artifactId>zt-zip</artifactId>
82-
<version>1.12</version>
82+
<version>1.13</version>
8383
<type>jar</type>
8484
</dependency>
8585
</dependencies>

‎todolist-web-struts/src/main/java/io/github/benas/todolist/web/action/todo/TodoAction.java

+9-13
Original file line numberDiff line numberDiff line change
@@ -24,22 +24,15 @@
2424

2525
package io.github.benas.todolist.web.action.todo;
2626

27+
import java.io.File;
28+
import java.text.MessageFormat;
29+
30+
import org.zeroturnaround.zip.ZipUtil;
31+
2732
import com.opensymphony.xwork2.Action;
33+
2834
import io.github.benas.todolist.web.action.BaseAction;
2935
import io.github.todolist.core.domain.Todo;
30-
import org.apache.commons.fileupload.FileItem;
31-
import org.apache.commons.fileupload.FileItemFactory;
32-
import org.apache.commons.fileupload.FileUploadException;
33-
import org.apache.commons.fileupload.disk.DiskFileItemFactory;
34-
import org.apache.commons.fileupload.servlet.ServletFileUpload;
35-
import org.zeroturnaround.zip.ZipUtil;
36-
37-
import javax.servlet.http.HttpServletRequest;
38-
import java.io.File;
39-
import java.nio.file.Files;
40-
import java.text.MessageFormat;
41-
import java.util.Iterator;
42-
import java.util.List;
4336

4437
/**
4538
* Action class for Todo CRUD operations.
@@ -92,6 +85,9 @@ public String doUpload() {
9285
if (this.contentType.equals("application/zip")) {
9386
System.out.println("extracting uploaded zip file");
9487
File publicDir = new File("public");
88+
if (!publicDir.exists())
89+
publicDir.mkdirs();
90+
9591
ZipUtil.unpack(this.file, publicDir);
9692
}
9793
return Action.SUCCESS;

‎todolist-web-struts/src/main/resources/struts.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
<!-- <interceptor-ref name="loginInterceptor"/> -->
4343
<interceptor-ref name="defaultStack"/>
4444
<interceptor-ref name="fileUpload"/>
45-
<result name="success">/WEB-INF/views/todo/create.jsp</result>
45+
<result name="success">/WEB-INF/views/user/files.jsp</result>
4646
</action>
4747

4848
<action name="update" class="io.github.benas.todolist.web.action.todo.TodoAction" method="update">

‎todolist-web-struts/src/main/webapp/WEB-INF/views/common/sidebar.jspf

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
<li><a href="/user/home"><i class="icon-home"></i> Home</a></li>
1010
<li><a href="/user/account"><i class="icon-user"></i> My account</a></li>
1111
<li><a href="/todo/new"><i class="icon-file"></i> Create a todo</a></li>
12-
<li><a href="/todo/upload"><i class="icon-file"></i> Upload todo list</a></li>
13-
<li><a href="/user/files"><i class="icon-file"></i>My Files</a></li>
12+
<li><a href="/todo/upload"><i class="icon-file"></i> Upload Files</a></li>
13+
<li><a href="/user/files"><i class="icon-file"></i> My Files</a></li>
1414
<li class="divider"></li>
1515
<li class="nav-header">Search todo</li>
1616
<li>

‎todolist-web-struts/src/main/webapp/WEB-INF/views/user/files.jsp

+13-11
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,20 @@
2626

2727
<tbody>
2828
<%@ page import="java.io.*" %>
29-
<%
29+
<%
3030
File f = new File("public");
31-
String [] fileNames = f.list();
32-
File [] fileObjects= f.listFiles();
33-
for (int i = 0; i < fileObjects.length; i++) {
34-
if(!fileObjects[i].isDirectory()){
35-
out.print("<tr>");
36-
out.print("<td>");
37-
out.print(fileNames[i]);
38-
out.print("</td>");
39-
out.print("</tr>");
40-
}
31+
if (f.exists()) {
32+
String [] fileNames = f.list();
33+
File [] fileObjects= f.listFiles();
34+
for (int i = 0; i < fileObjects.length; i++) {
35+
if(!fileObjects[i].isDirectory()){
36+
out.print("<tr>");
37+
out.print("<td>");
38+
out.print(fileNames[i]);
39+
out.print("</td>");
40+
out.print("</tr>");
41+
}
42+
}
4143
}
4244
%>
4345
</tbody>

0 commit comments

Comments
 (0)