Fix traversal bug on extraction of bad jar/zip files during jetty-start

jetty-start/src/main/java/org/eclipse/jetty/start/FS.java

@@ -198,7 +198,14 @@ public static void extractZip(Path archive, Path destination) throws IOException
                     continue;
                 }
 
-                Path destFile = destination.resolve(entry.getName());
+                String entryName = entry.getName();
+                Path destFile = destination.resolve(entryName).normalize().toAbsolutePath();
+                // make sure extracted path does not escape the destination directory
+                if (!destFile.startsWith(destination))
+                {
+                    throw new IOException(String.format("Malicious Archive %s found with bad entry \"%s\"",
+                        archive, entryName));
+                }
                 if (!Files.exists(destFile))
                 {
                     FS.ensureDirectoryExists(destFile.getParent());

jetty-start/src/test/java/org/eclipse/jetty/start/FSTest.java

@@ -14,12 +14,18 @@
 package org.eclipse.jetty.start;
 
 import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.List;
 
+import org.eclipse.jetty.toolchain.test.MavenPaths;
 import org.eclipse.jetty.toolchain.test.MavenTestingUtils;
+import org.eclipse.jetty.toolchain.test.jupiter.WorkDir;
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 public class FSTest
@@ -45,6 +51,17 @@ public void testCanReadFile()
         assertTrue(FS.canReadFile(pom.toPath()), "Can read file: " + pom);
     }
 
+    @Test
+    public void testExtractEscaperZip(WorkDir workDir) throws IOException
+    {
+        Path archive = MavenPaths.findTestResourceFile("bad-libs/escaper.zip");
+        Path dest = workDir.getEmptyPathDir();
+        Path bad = Path.of("/tmp/evil.txt");
+        Files.deleteIfExists(bad);
+        assertThrows(IOException.class, () -> FS.extractZip(archive, dest));
+        assertFalse(Files.exists(bad), "The escaper prevention didn't work, you should not have a /tmp/evil.txt file, but you do.");
+    }
+
     /**
      * Utility method used by other test cases
      *