mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius Ciepluch
1ae41eea19
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
29 lines
964 B
Java
29 lines
964 B
Java
package cn.hutool.core.util;
|
|
|
|
import java.io.File;
|
|
import java.nio.charset.Charset;
|
|
import java.util.Enumeration;
|
|
import java.util.zip.ZipEntry;
|
|
import java.util.zip.ZipFile;
|
|
|
|
/**
|
|
* Excerpt of hutool ZipUtil.unzip before CVE-2018-17297 (Zip Slip / CWE-22).
|
|
* https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e
|
|
* parent fd77bb8718648f69a587046b735488a80123cc26
|
|
*/
|
|
public class ZipUtil {
|
|
public static File unzip(File zipFile, File outFile, Charset charset) throws Exception {
|
|
ZipFile zipFileObj = new ZipFile(zipFile, charset);
|
|
Enumeration<? extends ZipEntry> em = zipFileObj.entries();
|
|
while (em.hasMoreElements()) {
|
|
ZipEntry zipEntry = em.nextElement();
|
|
File outItemFile = new File(outFile, zipEntry.getName());
|
|
if (zipEntry.isDirectory()) {
|
|
outItemFile.mkdirs();
|
|
}
|
|
}
|
|
zipFileObj.close();
|
|
return outFile;
|
|
}
|
|
}
|