java 36 lines · 8 steps

Extracting a zip safely in Java

A zip extractor that streams each entry to disk while defending against path-traversal attacks.

Explained by highlit
Intermediate path-traversal streams file-io security resource-management
1public final class ZipExtractor {
2 
3 private final Path targetDir;
4 
5 public ZipExtractor(Path targetDir) {
6 this.targetDir = targetDir.toAbsolutePath().normalize();
7 }
8 
9 public void extract(Path archive) throws IOException {
10 try (ZipInputStream zis = new ZipInputStream(
11 new BufferedInputStream(Files.newInputStream(archive)))) {
12 ZipEntry entry;
13 while ((entry = zis.getNextEntry()) != null) {
14 Path resolved = resolveSafely(entry.getName());
15 if (entry.isDirectory()) {
16 Files.createDirectories(resolved);
17 } else {
18 Files.createDirectories(resolved.getParent());
19 try (OutputStream out = Files.newOutputStream(resolved,
20 StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING)) {
21 zis.transferTo(out);
22 }
23 }
24 zis.closeEntry();
25 }
26 }
27 }
28 
29 private Path resolveSafely(String entryName) throws IOException {
30 Path resolved = targetDir.resolve(entryName).normalize();
31 if (!resolved.startsWith(targetDir)) {
32 throw new IOException("Blocked path traversal attempt: " + entryName);
33 }
34 return resolved;
35 }
36}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Always validate resolved zip entry paths against the target root to prevent Zip Slip attacks.
  2. 2Normalizing paths up front makes later containment checks with startsWith reliable.
  3. 3Try-with-resources on nested streams guarantees handles close even when extraction fails.

Related explainers

java 
@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {
 

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter
Advanced 10 steps
rust 
use axum::{
    extract::{Path, State},
    response::sse::{Event, KeepAlive, Sse},
};

Streaming import progress with SSE in Axum

server-sent-events streams watch-channel
Advanced 7 steps
java 
package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern
Intermediate 5 steps
java 
public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;

Parsing an HTTP Cookie header in Java

string-parsing http url-decoding
Intermediate 6 steps
java 
public class TimedSocketReader {
 
    private static final int READ_TIMEOUT_MS = 5_000;
    private static final int CONNECT_TIMEOUT_MS = 3_000;

Reading a socket with connect and read timeouts

sockets timeouts io
Intermediate 8 steps
java 
public final class EncodingDetector {
 
    public enum Encoding {
        UTF_8, UTF_16LE, UTF_16BE, UTF_32LE, UTF_32BE, ASCII, UNKNOWN

Detecting text encoding from raw bytes in Java

byte-manipulation encoding-detection bitwise-operations
Intermediate 8 steps

Share this explainer

Here's the card — post it anywhere.

Extracting a zip safely in Java — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code