Fixing a Zip Path Traversal Vulnerability in Android app in Google Play Store - android-security

Question

The question has been asked (and answered) but I have not been able to get it to work in my code.
This is the support document:
https://support.google.com/faqs/answer/9294009
I have tried to use the answer from here:
Fixing a Zip Path Traversal Vulnerability In Android
My original code:
public void copyFiles() {
try {
String roms_dir = mm.getMainHelper().getInstallationDIR();
File fm = new File(roms_dir + File.separator + "saves/"
+ "dont-delete-" + getVersion() + ".bin");
if (fm.exists())
return;
fm.mkdirs();
fm.createNewFile();
// Create a ZipInputStream to read the zip file
BufferedOutputStream dest = null;
InputStream fis = mm.getResources().openRawResource(R.raw.files);
ZipInputStream zis = new ZipInputStream(
new BufferedInputStream(fis));
// Loop over all of the entries in the zip file
int count;
byte data[] = new byte[BUFFER_SIZE];
ZipEntry entry;
while ((entry = zis.getNextEntry()) != null) {
if (!entry.isDirectory()) {
String destination = roms_dir;
String destFN = destination + File.separator
+ entry.getName();
// Write the file to the file system
FileOutputStream fos = new FileOutputStream(destFN);
dest = new BufferedOutputStream(fos, BUFFER_SIZE);
while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
dest.write(data, 0, count);
}
dest.flush();
dest.close();
} else {
File f = new File(roms_dir + File.separator
+ entry.getName());
f.mkdirs();
}
}
zis.close();
String dir = this.getInstallationDIR();
if(!dir.endsWith("/"))dir+="/";
String rompath = mm.getPrefsHelper().getROMsDIR() != null && mm.getPrefsHelper().getROMsDIR()!="" ? mm
.getPrefsHelper().getROMsDIR() : dir + "roms";
mm.getDialogHelper()
.setInfoMsg(
"Created or updated: '"
+ dir
+ "' to store save states, cfg files and MAME assets.\n\nBeware, copy or move your zipped ROMs under '"
+ rompath
+ "' directory!\n\nMAME4droid 0.139 uses only 0.139 MAME romset.");
mm.showDialog(DialogHelper.DIALOG_INFO);
} catch (Exception e) {
e.printStackTrace();
}
}
I have tried this:
public void copyFiles() {
try {
String roms_dir = mm.getMainHelper().getInstallationDIR();
File fm = new File(roms_dir + File.separator + "saves/"
+ "dont-delete-" + getVersion() + ".bin");
if (fm.exists())
return;
fm.mkdirs();
fm.createNewFile();
// Create a ZipInputStream to read the zip file
BufferedOutputStream dest = null;
InputStream fis = mm.getResources().openRawResource(R.raw.files);
ZipInputStream zis = new ZipInputStream(new BufferedInputStream(fis));
// Loop over all of the entries in the zip file
int count;
byte data[] = new byte[BUFFER_SIZE];
ZipEntry entry;
while ((entry = zis.getNextEntry()) != null) {
// Create an outputFile object and check that the path is safe with ensureZipPathSafety
//*
String outputDir = "";
File outputFile = new File(outputDir, entry.getName());
String outputFileName = outputFile.getCanonicalPath();
System.out.println(outputFileName);
try {
ensureZipPathSafety(outputFile, outputDir);
} catch (Exception e) {
e.printStackTrace();
return;
}
//*/
if (!entry.isDirectory()) {
System.out.println("We get past !entry.isDirectory check");
String destination = roms_dir;
String destFN = destination + File.separator
+ entry.getName();
// Write the file to the file system
FileOutputStream fos = new FileOutputStream(destFN);
dest = new BufferedOutputStream(fos, BUFFER_SIZE);
while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
dest.write(data, 0, count);
}
dest.flush();
dest.close();
} else {
File f = new File(roms_dir + File.separator
+ entry.getName());
f.mkdirs();
}
}
zis.close();
String dir = this.getInstallationDIR();
if(!dir.endsWith("/"))dir+="/";
String rompath = mm.getPrefsHelper().getROMsDIR() != null && mm.getPrefsHelper().getROMsDIR()!="" ? mm
.getPrefsHelper().getROMsDIR() : dir + "roms";
mm.getDialogHelper()
.setInfoMsg(
"Created or updated: '"
+ dir
+ "' to store save states, cfg files and MAME assets.\n\nBeware, copy or move your zipped ROMs under '"
+ rompath
+ "' directory!\n\nMAME4droid 0.139 uses only 0.139 MAME romset.");
mm.showDialog(DialogHelper.DIALOG_INFO);
} catch (Exception e) {
e.printStackTrace();
}
}
private void ensureZipPathSafety(final File outputFile, final String destDirectory) throws Exception {
String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
String outputFilecanonicalPath = outputFile.getCanonicalPath();
String outputFileCanonicalPath = "";
if (!outputFileCanonicalPath.startsWith(destDirCanonicalPath)) {
Object canonicalPath = null;
throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", canonicalPath));
}
}