Provide helper to detect "Zip Slip" exploit

[itzg]

So far this is being addressed one-off such as in itzg/docker-minecraft-server#4247

There's also a one-off verification here in the helper code. Should also consolidate and use that in more place to pre-verify.

[harrisonablack]

I'm happy to look at this, potentially adding some class to wrap the unzip and check process, similar to what was added here

[itzg]

Perfect. I was hoping you'd notice this one 😄

This particular spot is immune to it since only the requested file is extracted, but see if you can organize it similarly in the files package.

mc-image-helper/src/main/java/me/itzg/helpers/files/IoStreams.java

Line 26 in 4b5f52e

public static <T> T readFileFromZip(Path zipFile, String entryName, EntryReader<T> entryReader) throws IOException {

[harrisonablack]

By "helper" i'm assuming your meaning a Picocli command which can be called from within docker-minecraft-server?

For example a command which could assert zip-slip safe zips, as well as actually unzip the zip, from either a bash or java environment?

[itzg]

Yep, that's indeed what I meant by a "helper" 😀 I think I meant to type out "helper command".

The core of it could be a reusable utility method in the files package that could be used in the place where you had the detection logic.

I actually hadn't thought about it also doing the full extraction, but that makes sense now that you mention it.