[8.3.0] Fix Arbitrary file access during archive extraction (Zip Slip) on DirectoryWriter

[odaysec]

bazel/third_party/java/proguard/proguard6.2.2/src/proguard/io/ZipFileDataEntry.java

Line 57 in a9dc595

String name = zipEntry.getName()

Fix the issue need to validate the file paths constructed from zip entry names to ensure they remain within the intended base directory. This can be achieved by normalizing the constructed file path and verifying that it starts with the normalized base directory path. If the validation fails, an exception should be thrown to prevent unsafe file operations.

The fix involves:

1. Modifying the getFile method in DirectoryWriter to validate the constructed file path.
2. Using File.getCanonicalFile() to normalize paths and ensure the constructed path is within the base directory.

---

References

Zip Slip Vulnerability
Path Traversal
CWE-22