Prevent arbitrary file writes with malicious resource names.

[iBotPeaches]

Fixes: #GHSA-2hqv-2xv4-5h5w

[iBotPeaches]

I clearly suck at understanding Windows pathing and cross-platform. Will revisit after some learning/research

[0x33c0unt]

I still think that we can stick to extracting to the same path inside of the apk/zip itself. Basically unzipping but decoding some types on-the-fly.

[iBotPeaches]

The challenge I suffer with here is that Path/File want to detect the path separator from the host OS. I want to specify one because as you mentioned these are paths correlating to Zip/Apk and then transitioned to host system. So for now - a basic check for traversal, which should suffice.

[0x33c0unt]

Looks nice. Great effort!

[ajinabraham]

@iBotPeaches Can you cut a new release for apktool with this patch? I see that there is 2.10.0 scoped for April. Since this is a security fix, can we get a fixed version in the interim?

[iBotPeaches]

@iBotPeaches Can you cut a new release for apktool with this patch? I see that there is 2.10.0 scoped for April. Since this is a security fix, can we get a fixed version in the interim?

I was planning a patch release this weekend.

[iBotPeaches]

@iBotPeaches Can you cut a new release for apktool with this patch? I see that there is 2.10.0 scoped for April. Since this is a security fix, can we get a fixed version in the interim?

Now its out - v2.9.2 - https://apktool.org/blog/apktool-2.9.2