Merge commit from fork

Author: jonahgraham

plugins/org.eclipse.embedcdt.debug.gdbjtag.core/src/org/eclipse/embedcdt/debug/gdbjtag/core/datamodel/SvdUtils.java

@@ -437,12 +437,16 @@ public static Leaf getTree(IPath path) throws CoreException {
 				// This is the signature of ZIP files.
 				try (ZipInputStream zipInput = new ZipInputStream(new FileInputStream(file))) {
 					// Get the zipped file list entry
+					File destRoot = PacksStorage.getCacheFolder().getCanonicalFile();
 					ZipEntry zipEntry = zipInput.getNextEntry();
 					while (zipEntry != null) {
 						if (!zipEntry.isDirectory()) {
 							String fileName = zipEntry.getName();
 
-							File outFile = PacksStorage.getCachedFileObject(fileName);
+							File outFile = PacksStorage.getCachedFileObject(fileName).getCanonicalFile();
+							if (!outFile.toPath().startsWith(destRoot.toPath())) {
+								throw new IOException("Zip entry outside target dir, aborting extraction: " + fileName);
+							}
 							if (!outFile.getParentFile().exists()) {
 								outFile.getParentFile().mkdirs();
 							}

plugins/org.eclipse.embedcdt.packs.core/META-INF/MANIFEST.MF

@@ -2,7 +2,7 @@ Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-Name: %bundle.name
 Bundle-SymbolicName: org.eclipse.embedcdt.packs.core;singleton:=true
-Bundle-Version: 3.1.4.qualifier
+Bundle-Version: 3.2.0.qualifier
 Bundle-Activator: org.eclipse.embedcdt.internal.packs.core.Activator
 Bundle-RequiredExecutionEnvironment: JavaSE-11
 Bundle-ActivationPolicy: lazy

plugins/org.eclipse.embedcdt.packs.core/src/org/eclipse/embedcdt/packs/core/data/PacksStorage.java

@@ -82,6 +82,18 @@ public static File getCachedFileObject(String name) throws IOException {
 		return file; // Cannot return null
 	}
 
+	/**
+	 * @since 3.2
+	 */
+	public static File getCacheFolder() throws IOException {
+		IPath path = getFolderPath().append(CACHE_FOLDER);
+		File file = path.toFile();
+		if (file == null) {
+			throw new IOException(CACHE_FOLDER + " File object null.");
+		}
+		return file; // Cannot return null
+	}
+
 	public static File getPackageFileObject(String vendor, String packageName, String version, String name)
 			throws IOException {
 

plugins/org.eclipse.embedcdt.packs.core/src/org/eclipse/embedcdt/packs/core/jobs/InstallJob.java

@@ -328,6 +328,7 @@ private boolean copyFile(URL sourceUrl, File destinationFile) throws IOException
 
 	private boolean unzip(File archiveFile, IPath destRelativePath) throws IOException {
 
+		File destRoot = PacksStorage.getFileObject(destRelativePath.toString()).getCanonicalFile();
 		fOut.println("Unzipping \"" + archiveFile + "\"...");
 
 		boolean result = true;
@@ -346,8 +347,11 @@ private boolean unzip(File archiveFile, IPath destRelativePath) throws IOExcepti
 
 					String fileName = zipEntry.getName();
 
-					IPath path = destRelativePath.append(fileName);
-					File outFile = PacksStorage.getFileObject(path.toString());
+					File outFile = new File(destRoot, fileName).getCanonicalFile();
+					if (!outFile.toPath().startsWith(destRoot.toPath())) {
+						throw new IOException("Zip entry outside target dir, aborting extraction: " + fileName);
+					}
+
 					if (!outFile.getParentFile().exists()) {
 						outFile.getParentFile().mkdirs();
 					}