[javasecurity:S6096] Zip slip reported when prevented using Java NIO

[Dave562]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Then tell us:

• What language is this for?
  • Java
• Which rule?
  • javasecurity:S6096
• Why do you believe it’s a false-positive?
  • It is prevented by checking normalized path with targetDirectory path as described here
• Are you using
  • SonarQube - Enterprise Edition Version 10.2 (build 77647)
• How can we reproduce the problem?

import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Path;
import java.util.Enumeration;
import java.util.zip.ZipEntry;
import java.util.zip.ZipFile;

public class Example {

    private static final String targetDirectory = "/example/directory/";

    public void extractEntry(ZipFile zipFile) throws IOException {

        Enumeration<? extends ZipEntry> entries = zipFile.entries();
        while (entries.hasMoreElements()) {
            ZipEntry entry = entries.nextElement();
            String name = entry.getName();
            String dest = targetDirectory + name;
            if (!Path.of(dest).normalize().startsWith(Path.of(targetDirectory).normalize())) {
                throw new IOException("Entry is outside of the target dir.");
            }
            try (InputStream zis = zipFile.getInputStream(entry);
                 FileOutputStream fos = new FileOutputStream(dest)) {
                byte[] readBuffer = new byte[4096];
                int bytesIn;
                while ((bytesIn = zis.read(readBuffer)) != -1) {
                    fos.write(readBuffer, 0, bytesIn);
                }
                fos.flush();
            }
        }
    }
}