diff --git a/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java b/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java index 64f261f3c..3f333830a 100644 --- a/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java +++ b/frontend-plugin-core/src/main/java/com/github/eirslett/maven/plugins/frontend/lib/ArchiveExtractor.java @@ -106,11 +106,12 @@ public void extract(String archive, String destinationDirectory) throws ArchiveE TarArchiveEntry tarEntry = tarIn.getNextTarEntry(); while (tarEntry != null) { // Create a file for this tarEntry + final File directoryPath = new File(destinationDirectory); final File destPath = new File(destinationDirectory + File.separator + tarEntry.getName()); prepDestination(destPath, tarEntry.isDirectory()); - if (!destPath.getCanonicalPath().startsWith(destinationDirectory)) { + if (!destPath.getCanonicalPath().startsWith(directoryPath.getCanonicalPath())) { throw new IOException( - "Expanding " + tarEntry.getName() + " would create file outside of " + destinationDirectory + "Expanding " + tarEntry.getName() + " would create file " + destPath.getCanonicalPath() + ", which is outside of " + directoryPath.getCanonicalPath() ); } if (!tarEntry.isDirectory()) {