bytedance/AabResGuard

Path Manipulation: Zip Entry Overwrite

QiAnXinCodeSafe opened this issue · 0 comments

QiAnXinCodeSafe commented

AabResGuard/core/src/main/java/com/bytedance/android/aabresguard/utils/FileOperation.java

Line 72 in 4e90204

FileOutputStream fos = new FileOutputStream(file);

Path Manipulation: ZIP Entry Overwrite errors occur when a ZIP file is opened and expanded without checking the file path of the ZIP entry.Allowing user input to control the targetDir could allow an attacker to overwrite files on the system at will.