title: What are some possible reasons for "Zip Path Traversal Vulnerability" happens only in Android 11?
body: <p>Based on <a href="https://support.google.com/faqs/answer/9294009" rel="nofollow noreferrer">https://support.google.com/faqs/answer/9294009</a>, we implement &quot;Zip Path Traversal Vulnerability&quot; detection in our code.</p>
  <p>We are getting crash log from Google Play Console, as we run <code>throw new SecurityException(&quot;https://support.google.com/faqs/answer/9294009&quot;);</code> explicitly when we encounter <strong>&quot;Zip Path Traversal Vulnerability&quot;</strong>.</p>
  <p>Currently, sometimes, I have <strong>&quot;Zip Path Traversal Vulnerability&quot;</strong> happens only in Android 11.</p>
  <pre><code>public static boolean extractZipFile(InputStream inputStream, String destDirectory, boolean overwrite) {
      ZipInputStream zipInputStream = null;
      boolean status = true;
  
      try {
          zipInputStream = new ZipInputStream(inputStream);
          final byte[] data = new byte[1024];
  
          while (true) {
              ZipEntry zipEntry = null;
              FileOutputStream outputStream = null;
  
              try {
                  zipEntry = zipInputStream.getNextEntry();
  
                  if (zipEntry == null) {
                      break;
                  }
  
                  final File destination = new File(destDirectory, zipEntry.getName());
                  final String canonicalPath = destination.getCanonicalPath();
                  if (!canonicalPath.startsWith(destDirectory)) {
                      throw new SecurityException(&quot;https://support.google.com/faqs/answer/9294009&quot;);
                  }
  </code></pre>
  <p>I always ensure <code>destDirectory</code> is non null, before calling <code>extractZipFile</code></p>
  <pre><code>public static boolean extractZipFile(InputStream inputStream, boolean overwrite) {
      String destDirectory = Utils.getUserDataDirectory();
      if (destDirectory == null) {
          return false;
      }
      return extractZipFile(inputStream, destDirectory, overwrite);
  }
  
  public static String getUserDataDirectory() {
      if (externalFilesDir == null) {
          File _externalFilesDir = JStockApplication.instance().getExternalFilesDir(null);
          externalFilesDir = _externalFilesDir;
          if (externalFilesDir == null) {
              return null;
          }
      }
      
      return toEndWithFileSeperator(externalFilesDir.toString()) + getApplicationVersionString() + File.separator;
  }
  
  private static String toEndWithFileSeperator(String string) {
      if (string.endsWith(File.separator)) {
          return string;
      }
      return string + File.separator;
  }
  
  public static String getApplicationVersionString() {
      return &quot;1.0.7&quot;;
  }
  </code></pre>
  <p>Based on the posed source code, do you have any guess reason, why  &quot;Zip Path Traversal Vulnerability&quot; happens only in Android 11? I use emulator Android 11 but not able to reproduce the problem.</p>
  <hr />
  <h2>Where does the zip file come from?</h2>
  <p>The zip file comes from 2 places</p>
  <p>Bundled with APK as shown in below screenshot</p>
  <p><a href="https://i.stack.imgur.com/LspTg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LspTg.png" alt="enter image description here" /></a></p>
  <p>We use the following code to extract it during runtime.</p>
  <pre><code>private void initPreloadDatabase(boolean overWrite) {
      AssetManager assetManager = getResources().getAssets();
      InputStream inputStream = null;
      try {
          inputStream = assetManager.open(&quot;database&quot; + File.separator + &quot;database.zip&quot;);
      } catch (IOException e) {
          Log.e(TAG, &quot;&quot;, e);
      }
      if (inputStream != null) {
          org.yccheok.jstock.gui.Utils.extractZipFile(inputStream, overWrite);
      }
  }
  </code></pre>
  <p>Another zip file is downloaded from</p>
  <p><a href="https://raw.githubusercontent.com/yccheok/jstock/master/appengine/jstock-android-static/war/stocks_information/unitedstate/stocks.zip" rel="nofollow noreferrer">https://raw.githubusercontent.com/yccheok/jstock/master/appengine/jstock-android-static/war/stocks_information/unitedstate/stocks.zip</a></p>