[#514] fix contains('..') in path in jar file

highsource · Apr 1, 2024 · 7ba6830 · 7ba6830
1 parent d4a51e5
commit 7ba6830
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/maven-plugin/plugin-core/src/main/java/org/jvnet/jaxb/maven/util/JarScanner.java b/maven-plugin/plugin-core/src/main/java/org/jvnet/jaxb/maven/util/JarScanner.java
@@ -52,7 +52,7 @@ public void scan() {
             while (jarFileEntries.hasMoreElements()) {
                 JarEntry entry = jarFileEntries.nextElement();
                 String name = entry.getName();
-                if (name.startsWith("..") || name.startsWith("/")) {
+                if (name.contains("..") || name.startsWith("/")) {
                     // ignore "zip slip" file pattern attack
                     continue;
                 }