Fixes for path traversal vulnerabilities

[TranceLove]

Description

Fix Extractor.extractEntry implementations that would allow carefully crafted archives to extract files above allowed places in filesystem.

Issue tracker

Automatic tests

• Added test cases

Manual tests

• Done

Build tasks success

Successfully running following tasks on local:

• ./gradlew assembledebug
• ./gradlew spotlessCheck

[Copilot]

Pull request overview

Hardens archive extraction against path traversal (“zip slip”) by adding canonical-path checks in multiple extractor implementations and adding regression tests with malicious archives.

Changes:

• Add canonical-path guards to ZIP/RAR/7z and Commons-Compress-based extractors to prevent writes outside the output directory.
• Extend entry-path validation logic in CompressedHelper.isEntryPathValid.
• Add malicious archive fixtures and new unit tests covering traversal attempts.

Reviewed changes

Copilot reviewed 8 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
app/src/main/java/com/amaze/filemanager/filesystem/compressed/extractcontents/helpers/ZipExtractor.kt	Adds canonical-path guard for ZipEntry extraction.
app/src/play/java/com/amaze/filemanager/filesystem/compressed/extractcontents/helpers/RarExtractor.kt	Strengthens canonical-path check for RAR extraction.
app/src/main/java/com/amaze/filemanager/filesystem/compressed/extractcontents/helpers/SevenZipExtractor.kt	Adds canonical-path guard for 7z extraction (file entries).
app/src/main/java/com/amaze/filemanager/filesystem/compressed/extractcontents/helpers/AbstractCommonsArchiveExtractor.kt	Adds canonical-path guard for Commons-Compress extractors (file entries).
app/src/main/java/com/amaze/filemanager/filesystem/compressed/CompressedHelper.java	Updates entry path validation logic.
app/src/test/java/com/amaze/filemanager/filesystem/compressed/extractcontents/ZipExtractorTest.kt	Adds malicious ZIP extraction test.
app/src/test/java/com/amaze/filemanager/filesystem/compressed/extractcontents/TarGzExtractorTest.kt	Adds malicious tar.gz extraction test.
app/src/test/java/com/amaze/filemanager/filesystem/compressed/extractcontents/SevenZipExtractorTest.kt	Adds malicious 7z extraction test.
app/src/test/resources/malicious.zip	Adds malicious ZIP fixture.
app/src/test/resources/malicious.tar.gz	Adds malicious tar.gz fixture.
app/src/test/resources/malicious.7z	Adds malicious 7z fixture.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EmmanuelMess]

Testing on API 21 emulator:

• extracting the malicious.tar.gz shows "Done" toast but nothing gets extracted.
• malicious.7z shows "Error" and half extracts.
• Extracting malicious.tar.gz twice breaks the app, for example, the extraction notification never ends and, for deleting folders, the folder size never loads.
• Extracting malicious.zip shows correct toast, and half extracts.

Should rar be tested?

[EmmanuelMess]

This would mark valid paths that contain ".." as invalid. For example: dir1/dir2/.. is valid if dir1 is in the compressed file.

[EmmanuelMess]

I think this code is repeated verbatim 3 times, is it possible to at least move the check to a function?