SeleniumHQ
diff --git a/‎java/client/src/org/openqa/selenium/io/Zip.java‎
Lines changed: 5 additions & 0 deletions b/‎java/client/src/org/openqa/selenium/io/Zip.java‎
Lines changed: 5 additions & 0 deletions
@@ -110,7 +110,12 @@ public static void unzip(InputStream source, File outputDir) throws IOException
   }
 
   public static void unzipFile(File output, InputStream zipStream, String name) throws IOException {
+    String canonicalDestinationDirPath = output.getCanonicalPath();
     File toWrite = new File(output, name);
+    String canonicalDestinationFile = toWrite.getCanonicalPath();
+    if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator)) {
+      throw new IOException("Entry is outside of the target dir: " + name);
+    }
 
     if (!FileHandler.createDir(toWrite.getParentFile()))
       throw new IOException("Cannot create parent directory for: " + name);