From e28c251a2dbf97e5e8273177d05a6f8743c9902c Mon Sep 17 00:00:00 2001
From: AB <a.bierler@xdev-software.de>
Date: Wed, 15 Oct 2025 11:20:00 +0200
Subject: [PATCH] Detect ZIP slip

---
 .config/pmd/java/ruleset.xml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml
index 4570323..c72b66a 100644
--- a/.config/pmd/java/ruleset.xml
+++ b/.config/pmd/java/ruleset.xml
@@ -316,6 +316,28 @@
 		</properties>
 	</rule>
 
+	<rule name="EnsureZipEntryNameIsSanitized"
+		language="java"
+		message="ZipEntry name should be sanitized"
+		class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
+		<description>
+			ZipEntry name should be sanitized.
+			Unsanitized names may contain '..' which can result in path traversal ("ZipSlip").
+
+			You can suppress this warning when you properly sanitized the name.
+		</description>
+		<priority>4</priority>
+		<properties>
+			<property name="xpath">
+				<value>
+<![CDATA[
+//MethodCall[pmd-java:matchesSig('java.util.zip.ZipEntry#getName()') or pmd-java:matchesSig('org.apache.commons.compress.archivers.ArchiveEntry#getName()')]
+]]>
+				</value>
+			</property>
+		</properties>
+	</rule>
+
 	<rule name="JavaObjectSerializationIsUnsafe"
 		language="java"
 		message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"