Zip Path Traversal vulnerability

[webberig]

We uploaded an app to the play store which is being blocked for production because of following security error:

Your app contains an unsafe unzipping pattern that may lead to a Path Traversal vulnerability. Please see this Google Help Center article to learn how to fix the issue.

• org.apache.cordova.Zip.unzipSync

The error links to following article:
https://support.google.com/faqs/answer/9294009

[carlos-hs]

Hello @webberig ,

I've tried updating the "node_modules\cordova-plugin-zip\src\android\Zip.java" with the changes from your PR and I keep receiving the error from Google play.

Am I doing it right?

[webberig]

@carlos-hs I'm pretty sure you'll need to update the same file located in the /plugins folder of your project. The files are being copied when Cordova installs the plugins

[priyankaprakasan]

Hi @webberig ,
Could you able to solve this issue. I also got the same warning in pre-launch report.

[webberig]

I actually did, see #92...

[ZumelzuR]

?

[mbilalsardar]

Sir same issue is arising when i am trying to publish app with latest integration code as of 11 Jan 2021.
Branch : moodle app latest integration branch.

error
Zip Path Traversal
Your app contains an unsafe unzipping pattern that may lead to a Path Traversal vulnerability. Please see this Google Help Center article to learn how to fix the issue.
    org.apache.cordova.Zip.unzipSync

[uareurapid]

try to enclose it on an "else" statement, like this:

File file = new File(outputDirectory + compressedName);
          
String canonicalPath = file.getCanonicalPath();
if (!canonicalPath.startsWith(outputDirectory)) {
     String errorMessage = "Zip traversal security error";
     callbackContext.error(errorMessage);
     Log.e(LOG_TAG, errorMessage);
      return;
} else {

    file.getParentFile().mkdirs();
    if(file.exists() || file.createNewFile()){
        Log.w("Zip", "extracting: " + file.getPath());
        FileOutputStream fout = new FileOutputStream(file);
        int count;
        while ((count = zis.read(buffer)) != -1)
        {
           fout.write(buffer, 0, count);
        }
        fout.close();
     } 
}

Worked for me, no errors anymore on Google Play

cheers