From 254c53f0df825764ba2b9e20fc7b1de60c85e1d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Kubitz?= <jkubitz-eclipse@gmx.de>
Date: Wed, 20 Mar 2024 11:46:33 +0100
Subject: [PATCH] Backport : Fix regression in zipSlip

---
 .../jdt/core/tests/model/UtilTests.java       | 26 +++++++++++++++++++
 org.eclipse.jdt.core/META-INF/MANIFEST.MF     |  2 +-
 .../internal/core/JarPackageFragmentRoot.java |  6 ++---
 .../eclipse/jdt/internal/core/util/Util.java  |  9 +++++++
 org.eclipse.jdt.core/pom.xml                  |  2 +-
 5 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/model/UtilTests.java b/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/model/UtilTests.java
index e6a36d396e2..47c4396edfa 100644
--- a/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/model/UtilTests.java
+++ b/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/model/UtilTests.java
@@ -115,4 +115,30 @@ public void testTypeSignature() {
 		assertEquals("Qqualifier.id;", Util.getSignature(type));
 	}
 
+	public void testGetSafeName() {
+		assertGetSafeNamePass("simple");
+		assertGetSafeNamePass("dir1/dir2/normal");
+		assertGetSafeNamePass("dir1/../unnormal");
+		assertGetSafeNamePass("dir1/dir2/.../unnormalTripple");
+		assertGetSafeNameFail("../slipped");
+		assertGetSafeNameFail("dir1/../../slipped");
+
+		// https://github.com/eclipse-jdt/eclipse.jdt.core/pull/2015#issuecomment-2009162226
+		assertGetSafeNamePass("overrides/..ROOT...override");
+	}
+
+	private void assertGetSafeNamePass(String entryName) {
+		String zipfileName = "any";
+		assertEquals(entryName, Util.getEntryName(zipfileName, new java.util.zip.ZipEntry(entryName)));
+	}
+
+	private void assertGetSafeNameFail(String entryName) {
+		String zipfileName = "any";
+		try {
+			String n = Util.getEntryName(zipfileName, new java.util.zip.ZipEntry(entryName));
+			assertFalse("Expected IllegalArgumentException but got " + n, true);
+		} catch (IllegalArgumentException expected) {
+			// expected
+		}
+	}
 }
\ No newline at end of file
diff --git a/org.eclipse.jdt.core/META-INF/MANIFEST.MF b/org.eclipse.jdt.core/META-INF/MANIFEST.MF
index bef66a8e77d..9722a37e26f 100644
--- a/org.eclipse.jdt.core/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core/META-INF/MANIFEST.MF
@@ -2,7 +2,7 @@ Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-Name: %pluginName
 Bundle-SymbolicName: org.eclipse.jdt.core; singleton:=true
-Bundle-Version: 3.37.0.qualifier
+Bundle-Version: 3.37.1.qualifier
 Bundle-Activator: org.eclipse.jdt.core.JavaCore
 Bundle-Vendor: %providerName
 Bundle-Localization: plugin
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java
index f331d97f3d2..f370b3cb58e 100644
--- a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java
+++ b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JarPackageFragmentRoot.java
@@ -150,10 +150,7 @@ protected boolean computeChildren(OpenableElementInfo info, IResource underlying
 				int length = version.length();
 				for (Enumeration<? extends ZipEntry> e= jar.entries(); e.hasMoreElements();) {
 					ZipEntry member= e.nextElement();
-					String name = member.getName();
-					if (name.contains("..")) { //$NON-NLS-1$
-						throw new IllegalArgumentException("Bad zip entry: "+name+" in "+jar.getName()); //$NON-NLS-1$ //$NON-NLS-2$
-					}
+					String name = Util.getEntryName(jar.getName(), member);
 					if (this.multiVersion && name.length() > (length + 2) && name.startsWith(version)) {
 						int end = name.indexOf('/', length);
 						if (end >= name.length()) continue;
@@ -194,6 +191,7 @@ protected boolean computeChildren(OpenableElementInfo info, IResource underlying
 		((JarPackageFragmentRootInfo) info).overriddenClasses = overridden;
 		return true;
 	}
+
 	protected IJavaElement[] createChildren(final HashtableOfArrayToObject rawPackageInfo) {
 		IJavaElement[] children;
 		// loop through all of referenced packages, creating package fragments if necessary
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/util/Util.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/util/Util.java
index 395719f8d65..3a4028d4fc1 100644
--- a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/util/Util.java
+++ b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/util/Util.java
@@ -3341,4 +3341,13 @@ public static IMethod findMethod(IType type, char[] selector, String[] paramType
 		}
 		return method;
 	}
+
+	public static String getEntryName(String zipfileName, ZipEntry entry) {
+		String entryName = entry.getName();
+		if (!java.nio.file.Path.of(zipfileName, entryName).normalize()
+				.startsWith(java.nio.file.Path.of(zipfileName).normalize())) {
+			throw new IllegalArgumentException("Bad zip entry: " + entryName + " in " + zipfileName); //$NON-NLS-1$ //$NON-NLS-2$
+		}
+		return entryName; // did not escape
+	}
 }
diff --git a/org.eclipse.jdt.core/pom.xml b/org.eclipse.jdt.core/pom.xml
index 9961471b423..2bc09978701 100644
--- a/org.eclipse.jdt.core/pom.xml
+++ b/org.eclipse.jdt.core/pom.xml
@@ -17,7 +17,7 @@
     <version>4.31.0-SNAPSHOT</version>
   </parent>
   <artifactId>org.eclipse.jdt.core</artifactId>
-  <version>3.37.0-SNAPSHOT</version>
+  <version>3.37.1-SNAPSHOT</version>
   <packaging>eclipse-plugin</packaging>
 
   <properties>