How to Unzip a ZIP File in Java

In this tutorial, we will learn how to unzip a ZIP file using Java’s built-in java.util.zip package, while also discussing the Zip Slip vulnerability and how to avoid it.

Table of Contents:

• 1. Extracting a ZIP File in Java
• 2. Understanding the Zip Slip Vulnerability
  • What is Zip Slip?
  • How to Prevent Zip Slip?
  • Secure Validation Code
  • Legacy java.io.* Validation Code
• 3. References

1. Extracting a ZIP File in Java

We can use the ZipInputStream class from java.util.zip to extract files from a ZIP archive. Here’s a step-by-step example:

package com.mkyong.unzip;

import java.io.BufferedOutputStream;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;

public class UnzipUtility {

    public static void unzip(String zipFilePath, String destDirectory) 
            throws IOException {

        Path destDirPath = Paths.get(destDirectory);
        if (!Files.exists(destDirPath)) {
            Files.createDirectories(destDirPath);
        }

        try (ZipInputStream zipIn = new ZipInputStream(
                Files.newInputStream(Paths.get(zipFilePath)))) {
            ZipEntry entry = zipIn.getNextEntry();

            while (entry != null) {
                Path outPath = destDirPath.resolve(entry.getName()).normalize();

                // Prevent Zip Slip vulnerability
                if (!outPath.startsWith(destDirPath)) {
                    throw new IOException("Entry is outside of target dir: " 
                            + entry.getName());
                }

                if (entry.isDirectory()) {
                    Files.createDirectories(outPath);
                } else {
                    extractFile(zipIn, outPath);
                }
                zipIn.closeEntry();
                entry = zipIn.getNextEntry();
            }
        }
    }

    private static void extractFile(ZipInputStream zipIn, Path outPath) 
            throws IOException {

        // Ensure parent directories exist before creating the file
        // Create all necessary parent directories before writing the file.
        // Prevents NoSuchFileException for nested folders like /folder1/folder2/file.txt
        Files.createDirectories(outPath.getParent());

        try (BufferedOutputStream bos = new BufferedOutputStream(
                Files.newOutputStream(outPath))) {
            byte[] buffer = new byte[4096];
            int bytesRead;
            while ((bytesRead = zipIn.read(buffer)) != -1) {
                bos.write(buffer, 0, bytesRead);
            }
        }
    }

    public static void main(String[] args) {
        String zipFilePath = "files.zip";
        String destDir = "outputDir";
        try {
            unzip(zipFilePath, destDir);
            System.out.println("Unzip successful!");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

2. Understanding the Zip Slip Vulnerability

What is Zip Slip?

Zip Slip is a path traversal vulnerability that allows an attacker to overwrite files outside the intended extraction directory. It happens when malicious ZIP archives contain filenames like:

../../../../etc/passwd

Without validation, this can overwrite critical system files.

How to Prevent Zip Slip?

To mitigate this risk, we must:

• Use Path#normalize() to resolve and sanitize paths.
• Ensure extracted paths stay within the intended directory using startsWith().

Secure Validation Code

We can add the following check in our code to prevent Zip Slip:

    Path outPath = destDirPath.resolve(entry.getName()).normalize();
    
    if (!outPath.startsWith(destDirPath)) {
        throw new IOException("Entry is outside of target dir: " + entry.getName());
    }

This ensures extracted files remain inside the target directory, preventing path traversal attacks.

Legacy java.io.* Validation Code

For the legacy java.io.*, we can add the following check in our code to prevent Zip Slip:

    String canonicalDestination = destDir.getCanonicalPath();
    String canonicalOutFile = outFile.getCanonicalPath();
    
    if (!canonicalOutFile.startsWith(canonicalDestination)) {
        throw new IOException("Entry is outside of target dir: " + entry.getName());
    }

3. References

• Java Zip Slip Vulnerability
• Official Java Zip API
• ZipInputStream JavaDoc
• Zip – Wikipedia
• zip4j library
• ZIP File Format Specification
• Create a Zip file in Java – Mkyong.com