Page Information

Title:	IDS04-J. Safely extract files from ZipInputStream
Author:	David Svoboda	Apr 08, 2011
Last Changed by:	Alexandre GIGLEUX	Dec 19, 2018
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/LjZGBQ
Export As:	Word · PDF

SEI CERT Oracle Coding Standard for Java (2)     Page: MSC05-J. Do not exhaust heap space     Page: IDS03-J. Do not log unsanitized user input

Parent Page     Page: Rule 00. Input Validation and Data Sanitization (IDS)

• draft
• ids
• android
• resource-exhaustion
• rule
• android-implementation-detail-java

Time	Editor
Dec 19, 2018 10:52	Alexandre GIGLEUX	View Changes
Dec 19, 2018 10:45	Alexandre GIGLEUX	View Changes
Jun 18, 2018 10:25	Derek Leung	View Changes
Jun 15, 2018 16:45	Derek Leung	View Changes
Add related vulnerability: "Zip Slip"
Sep 14, 2017 11:44	David Svoboda
CS bugfix

External Links (17)
    www.unforgettable.dk/
    en.wikipedia.org/wiki/Kilobyte
    cwe.mitre.org/
    cwe.mitre.org/data/definitions/409.html
    en.wikipedia.org/wiki/Zip_file
    https://snyk.io/blog/zip-slip-vulnerability/
    blog.sina.com.cn/s/blog_be6dacae0101bksm.html
    www.oracle.com/technetwork/java/seccodeguide-139067.html
    en.wikipedia.org/wiki/Petabyte
    en.wikipedia.org/wiki/Gibibyte
    en.wikipedia.org/wiki/Pebibyte
    https://rules.sonarsource.com/java/RSPEC-5042
    media.blackhat.com/us-13/US-13-Forristal-Android-One-Root-t…
    en.wikipedia.org/wiki/Zip_bomb#cite_note-4
    https://www.safaribooksonline.com/library/view/secure-codin…
    en.wikipedia.org/wiki/Gigabyte
    java.sun.com/developer/technicalArticles/Programming/compre…

SEI CERT Oracle Coding Standard for Java (11)     Page: Rule BB. Glossary     Page: FIO16-J. Canonicalize path names before validating them     Page: Rule AA. References     Page: SonarQube_V     Page: The Checker Framework_V     Page: The Checker Framework     Page: Rule 00. Input Validation and Data Sanitization (IDS)     Home page: SEI CERT Oracle Coding Standard for Java     Page: IDS05-J. Use a safe subset of ASCII for file and path names     Page: SonarQube     Page: IDS03-J. Do not log unsanitized user input