Merge commit '7250d8b875366ae90fa6aec13b5a5c86720e23a3' into security-master

core/src/main/java/hudson/FilePath.java

@@ -609,6 +609,10 @@ public final class FilePath implements Serializable {
             while (entries.hasMoreElements()) {
                 ZipEntry e = entries.nextElement();
                 File f = new File(dir, e.getName());
+                if (!f.toPath().normalize().startsWith(dir.toPath())) {
+                    throw new IOException(
+                        "Zip " + zipFile.getPath() + " contains illegal file name that breaks out of the target directory: " + e.getName());
+                }
                 if (e.isDirectory()) {
                     mkdirs(f);
                 } else {
@@ -918,7 +922,7 @@ public final class FilePath implements Serializable {
     /**
      * Copies the content of a URL to a remote file.
      * Unlike {@link #copyFrom} this will not transfer content over a Remoting channel.
-     * @since FIXME
+     * @since 2.119
      */
     @Restricted(Beta.class)
     public void copyFromRemotely(URL url) throws IOException, InterruptedException {
@@ -2294,7 +2298,8 @@ public final class FilePath implements Serializable {
                             if (f.isFile()) {
                                 File target = new File(dest, relativePath);
                                 mkdirsE(target.getParentFile());
-                                Util.copyFile(f, writing(target));
+                                Files.copy(fileToPath(f), fileToPath(writing(target)),
+                                        StandardCopyOption.COPY_ATTRIBUTES, StandardCopyOption.REPLACE_EXISTING);
                                 count.incrementAndGet();
                             }
                         }