Source:
public static void extractBPELArchive(final BPELDeploymentContext deploymentContext) throws Exception { try { ZipInputStream zipStream = new ZipInputStream( new FileInputStream(deploymentContext.getBpelArchive())); ZipEntry entry; String canonicalDescPath = new File(deploymentContext.getBpelPackageLocationInFileSystem()). getCanonicalPath(); while ((entry = zipStream.getNextEntry()) != null) { String canonicalEntryPath = new File(deploymentContext.getBpelPackageLocationInFileSystem() + File.separator + entry.getName()).getCanonicalPath(); if(!canonicalEntryPath.startsWith(canonicalDescPath)){ throw new Exception("Entry is outside of the target dir: " + entry.getName()); } if (entry.isDirectory()) { if (log.isDebugEnabled()) { log.debug("Extracting directory " + entry.getName()); } if (!new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()).mkdirs()) { throw new Exception("Archive extraction failed. Cannot create directory: " + new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()).getAbsolutePath() + "."); } continue; } if (entry.getName().endsWith(".cbp")) { if (log.isDebugEnabled()) { log.debug("Skipped extracting file: " + entry.getName()); } continue; } if (log.isDebugEnabled()) { log.debug("Extracting file " + entry.getName()); } File destFile = new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()); if (!destFile.getParentFile().exists() && !destFile.getParentFile().mkdirs()) { throw new Exception("Archive extraction failed. Cannot create directory: " + destFile.getParentFile().getAbsolutePath()); } copyInputStream(zipStream, new BufferedOutputStream(new FileOutputStream(destFile))); } zipStream.close(); } catch (IOException e) { String errMsg = "Error occurred during extracting the archive: " + deploymentContext.getArchiveName(); log.error(errMsg, e); throw new Exception(errMsg, e); } }

Target:
public static void extractBPELArchive(final BPELDeploymentContext deploymentContext) throws Exception { try { ZipInputStream zipStream = new ZipInputStream( new FileInputStream(deploymentContext.getBpelArchive())); ZipEntry entry; String canonicalDestPath = new File(deploymentContext.getBpelPackageLocationInFileSystem()). getCanonicalPath(); while ((entry = zipStream.getNextEntry()) != null) { String canonicalEntryPath = new File(deploymentContext.getBpelPackageLocationInFileSystem() + File.separator + entry.getName()).getCanonicalPath(); if(!canonicalEntryPath.startsWith(canonicalDestPath)){ throw new Exception("Entry is outside of the target dir: " + entry.getName()); } if (entry.isDirectory()) { if (log.isDebugEnabled()) { log.debug("Extracting directory " + entry.getName()); } if (!new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()).mkdirs()) { throw new Exception("Archive extraction failed. Cannot create directory: " + new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()).getAbsolutePath() + "."); } continue; } if (entry.getName().endsWith(".cbp")) { if (log.isDebugEnabled()) { log.debug("Skipped extracting file: " + entry.getName()); } continue; } if (log.isDebugEnabled()) { log.debug("Extracting file " + entry.getName()); } File destFile = new File(deploymentContext.getBpelPackageLocationInFileSystem(), entry.getName()); if (!destFile.getParentFile().exists() && !destFile.getParentFile().mkdirs()) { throw new Exception("Archive extraction failed. Cannot create directory: " + destFile.getParentFile().getAbsolutePath()); } copyInputStream(zipStream, new BufferedOutputStream(new FileOutputStream(destFile))); } zipStream.close(); } catch (IOException e) { String errMsg = "Error occurred during extracting the archive: " + deploymentContext.getArchiveName(); log.error(errMsg, e); throw new Exception(errMsg, e); } }