diff --git a/src/main/java/org/zeroturnaround/zip/ZipUtil.java b/src/main/java/org/zeroturnaround/zip/ZipUtil.java index 111ac85..3fda627 100644 --- a/src/main/java/org/zeroturnaround/zip/ZipUtil.java +++ b/src/main/java/org/zeroturnaround/zip/ZipUtil.java @@ -1140,7 +1140,7 @@ private static File checkDestinationFileForTraversal(File outputDir, String name * that the outputdir + name doesn't leave the outputdir. See * DirectoryTraversalMaliciousTest for details. */ - if (name.indexOf("..") != -1 && !destFile.getCanonicalPath().startsWith(outputDir.getCanonicalPath())) { + if (name.indexOf("..") != -1 && !destFile.getCanonicalFile().toPath().startsWith(outputDir.getCanonicalFile().toPath())) { throw new MaliciousZipException(outputDir, name); } return destFile;