see 05/07 log

Author: Blankj

README-CN.md

@@ -41,7 +41,7 @@
 
 [logo]: https://raw.githubusercontent.com/Blankj/AndroidUtilCode/master/art/logo.png
 
-[aucsvg]: https://img.shields.io/badge/AndroidUtilCode-v1.14.3-brightgreen.svg
+[aucsvg]: https://img.shields.io/badge/AndroidUtilCode-v1.14.4-brightgreen.svg
 [auc]: https://github.com/Blankj/AndroidUtilCode
 
 [apisvg]: https://img.shields.io/badge/API-14+-brightgreen.svg

README.md

@@ -41,7 +41,7 @@ If this project helps you a lot and you want to support the project's developmen
 
 [logo]: https://raw.githubusercontent.com/Blankj/AndroidUtilCode/master/art/logo.png
 
-[aucsvg]: https://img.shields.io/badge/AndroidUtilCode-v1.14.3-brightgreen.svg
+[aucsvg]: https://img.shields.io/badge/AndroidUtilCode-v1.14.4-brightgreen.svg
 [auc]: https://github.com/Blankj/AndroidUtilCode
 
 [apisvg]: https://img.shields.io/badge/API-14+-brightgreen.svg

app/build.gradle

@@ -56,7 +56,7 @@ dependencies {
     // LeakCanary
     debugImplementation "com.squareup.leakcanary:leakcanary-android:$leakcanary_version"
     releaseImplementation "com.squareup.leakcanary:leakcanary-android-no-op:$leakcanary_version"
-//    implementation 'com.blankj:utilcode:1.14.3'
+//    implementation 'com.blankj:utilcode:1.14.4'
 }
 
 

build.gradle

@@ -7,7 +7,7 @@ buildscript {
     dependencies {
         classpath 'com.android.tools.build:gradle:3.1.2'
         classpath 'com.github.dcendents:android-maven-gradle-plugin:1.5'
-        classpath 'com.jfrog.bintray.gradle:gradle-bintray-plugin:1.7.3'
+        classpath 'com.jfrog.bintray.gradle:gradle-bintray-plugin:1.8.0'
 
         classpath "tech.harmonysoft:traute-gradle:1.1.8"
         // NOTE: Do not place your application dependencies here; they belong
@@ -44,8 +44,8 @@ ext {
     min_sdk_version = 14
     target_sdk_version = 27
 
-    version_code = 1_014_003
-    version_name = '1.14.3'// E.g 1.9.72 => 1,009,072
+    version_code = 1_014_004
+    version_name = '1.14.4'// E.g 1.9.72 => 1,009,072
 
     // App dependencies
     support_version = '27.1.0'

update_log.md

@@ -1,3 +1,4 @@
+* 18/05/07 修复 ZipUtils 漏洞，发布 1.14.4 版本
 * 18/05/03 修复 ToastUtils 默认字体大小问题，发布 1.14.3 版本
 * 18/05/02 修复 PermissionUtils 空异常，发布 1.14.2 版本
 * 18/04/28 新增 FlashlightUtils，发布 1.14.1 版本

utilcode/README-CN.md

@@ -2,7 +2,7 @@
 
 Gradle:
 ```groovy
-implementation 'com.blankj:utilcode:1.14.3'
+implementation 'com.blankj:utilcode:1.14.4'
 ```
 
 

utilcode/README.md

@@ -2,7 +2,7 @@
 
 Gradle:
 ```groovy
-implementation 'com.blankj:utilcode:1.14.3'
+implementation 'com.blankj:utilcode:1.14.4'
 ```
 
 

utilcode/src/main/java/com/blankj/utilcode/util/ZipUtils.java

@@ -1,5 +1,7 @@
 package com.blankj.utilcode.util;
 
+import android.util.Log;
+
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
 import java.io.File;
@@ -291,12 +293,20 @@ public static List<File> unzipFileByKeyword(final File zipFile,
             while (entries.hasMoreElements()) {
                 ZipEntry entry = ((ZipEntry) entries.nextElement());
                 String entryName = entry.getName();
+                if (entryName.startsWith("../")) {
+                    Log.e("ZipUtils", "it's dangerous!");
+                    return files;
+                }
                 if (!unzipChildFile(destDir, files, zf, entry, entryName)) return files;
             }
         } else {
             while (entries.hasMoreElements()) {
                 ZipEntry entry = ((ZipEntry) entries.nextElement());
                 String entryName = entry.getName();
+                if (entryName.startsWith("../")) {
+                    Log.e("ZipUtils", "it's dangerous!");
+                    return files;
+                }
                 if (entryName.contains(keyword)) {
                     if (!unzipChildFile(destDir, files, zf, entry, entryName)) return files;
                 }