Fix Zip Slip vulnerability (CWE-22) in GenClass

[srikantharun]

Summary

Fixes a path traversal vulnerability (CWE-22) in GenClass.java that allows malicious JAR files to write files outside the intended extraction directory.

Problem

The extractGeneratedClasses method in GenClass accepts JarEntry.getName() values directly without path validation. A malicious JAR with entries containing ../ sequences could escape the extraction root and write files anywhere on the filesystem.

Solution

Two-layer protection:

1. Path normalization check:

Path outputPath = tempDir.resolve(name).normalize();
if (!outputPath.startsWith(tempDir)) {
    throw new IOException("Zip entry would escape extraction directory (Zip Slip attack)");
}

2. TOCTOU protection via symlink verification:

Files.createDirectories(parent);
if (!parent.toRealPath().startsWith(tempDir.toRealPath())) {
    throw new IOException("Zip entry would escape via symlink (Zip Slip attack)");
}

This prevents both:

• Basic ../ path traversal attacks
• Time-of-check to Time-of-use (TOCTOU) race conditions via symlinks

Security Impact

Prevents supply chain attacks where compromised transitive dependencies could achieve arbitrary file writes on developer machines or CI/CD runners, undermining Bazel's hermeticity guarantees.

Test plan

• Code compiles
• Path validation follows standard Zip Slip mitigation pattern
• TOCTOU protection via toRealPath() verification

Fixes #28120

[gemini-code-assist]

Code Review

This pull request correctly addresses the core Zip Slip vulnerability (CWE-22) by normalizing and validating the destination path for extracted JAR entries. This is a crucial security improvement. However, the current implementation remains vulnerable to a Time-of-check to Time-of-use (TOCTOU) race condition. An attacker could potentially use symlinks to bypass the validation between the path check and the file write operation. I have added a high-severity comment with a suggested code change to mitigate this race condition by verifying the real path of the parent directory after its creation.

[hvadehra]

I think this was done differently in 559326a