Source:
public static String extractArchive(File sourceFile, String destination) throws APIImportException { BufferedInputStream inputStream = null; InputStream zipInputStream = null; FileOutputStream outputStream = null; ZipFile zip = null; String archiveName = null; try { zip = new ZipFile(sourceFile); Enumeration zipFileEntries = zip.entries(); int index = 0; while (zipFileEntries.hasMoreElements()) { ZipEntry entry = (ZipEntry) zipFileEntries.nextElement(); String currentEntry = entry.getName(); if (index == 0) { archiveName = currentEntry.substring(0, currentEntry.indexOf( APIImportExportConstants.ZIP_FILE_SEPARATOR)); --index; } File destinationFile = new File(destination, currentEntry); File destinationParent = destinationFile.getParentFile(); String canonicalizedDestinationFilePath = destinationFile.getCanonicalPath(); if (!canonicalizedDestinationFilePath.startsWith(new File(destination).getCanonicalPath())) { String errorMessage = "Entry is outside of the target dir: " + currentEntry; log.error(errorMessage); throw new APIImportException(errorMessage); } if (destinationParent.mkdirs()) { log.info("Creation of folder is successful. Directory Name : " + destinationParent.getName()); } if (!entry.isDirectory()) { zipInputStream = zip.getInputStream(entry); inputStream = new BufferedInputStream(zipInputStream); outputStream = new FileOutputStream(destinationFile); IOUtils.copy(inputStream, outputStream); } } return archiveName; } catch (IOException e) { String errorMessage = "Failed to extract the archive (zip) file. "; log.error(errorMessage, e); throw new APIImportException(errorMessage, e); } finally { IOUtils.closeQuietly(zipInputStream); IOUtils.closeQuietly(inputStream); IOUtils.closeQuietly(outputStream); } }

Target:
public static String extractArchive(File sourceFile, String destination) throws APIImportException { BufferedInputStream inputStream = null; InputStream zipInputStream = null; FileOutputStream outputStream = null; ZipFile zip = null; String archiveName = null; try { zip = new ZipFile(sourceFile); Enumeration zipFileEntries = zip.entries(); int index = 0; while (zipFileEntries.hasMoreElements()) { ZipEntry entry = (ZipEntry) zipFileEntries.nextElement(); String currentEntry = entry.getName(); if (index == 0) { archiveName = currentEntry.substring(0, currentEntry.indexOf( APIImportExportConstants.ZIP_FILE_SEPARATOR)); --index; } File destinationFile = new File(destination, currentEntry); File destinationParent = destinationFile.getParentFile(); String canonicalizedDestinationFilePath = destinationFile.getCanonicalPath(); if (!canonicalizedDestinationFilePath.startsWith(new File(destination).getCanonicalPath())) { String errorMessage = "Attempt to upload invalid zip archive with file at " + currentEntry + ". File path is outside target directory"; log.error(errorMessage); throw new APIImportException(errorMessage); } if (destinationParent.mkdirs()) { log.info("Creation of folder is successful. Directory Name : " + destinationParent.getName()); } if (!entry.isDirectory()) { zipInputStream = zip.getInputStream(entry); inputStream = new BufferedInputStream(zipInputStream); outputStream = new FileOutputStream(destinationFile); IOUtils.copy(inputStream, outputStream); } } return archiveName; } catch (IOException e) { String errorMessage = "Failed to extract the archive (zip) file. "; log.error(errorMessage, e); throw new APIImportException(errorMessage, e); } finally { IOUtils.closeQuietly(zipInputStream); IOUtils.closeQuietly(inputStream); IOUtils.closeQuietly(outputStream); } }