ADFA-5005: Fix SDK bootstrap crash extracting android-sdk.zip

app/src/main/java/com/itsaky/androidide/assets/AssetsInstallationHelper.kt

@@ -245,6 +245,14 @@ object AssetsInstallationHelper {
 		Files.createDirectories(destDir)
 		// Normalize and make destDir absolute for secure path validation
 		val normalizedDestDir = destDir.toAbsolutePath().normalize()
+		val realDestDir = normalizedDestDir.toRealPath()
+
+		// Zip entries are commonly clustered by directory (e.g. dozens of files
+		// under the same build-tools/<version>/ prefix); cache the last-verified
+		// parent so consecutive entries under it skip a redundant toRealPath() call.
+		// Nothing below can turn an already-verified real directory into a symlink
+		// mid-run, so caching by lexical parent equality is safe.
+		var lastVerifiedParent: Path? = null
 
 		ZipInputStream(srcStream.buffered()).useEntriesEach { zipInput, entry ->
 			// Validate entry name doesn't contain dangerous patterns
@@ -260,9 +268,28 @@ object AssetsInstallationHelper {
 				throw IllegalStateException("Entry is outside of the target dir: ${entry.name}")
 			}
 
+			// The checks above are lexical (entry name only) and don't catch a symlink
+			// already present on disk (e.g. destDir merged/reused across installer
+			// runs). Reject writing through an existing symlink up front, then
+			// re-check containment against the real, on-disk path once created.
+			if (Files.isSymbolicLink(destFile)) {
+				throw IllegalStateException("Refusing to extract over an existing symlink: ${entry.name}")
+			}
+
 			if (entry.isDirectory) {
 				Files.createDirectories(destFile)
+				if (!destFile.toRealPath().startsWith(realDestDir)) {
+					throw IllegalStateException("Entry escapes the target dir via symlink: ${entry.name}")
+				}
 			} else {
+				Files.createDirectories(destFile.parent)
+				if (destFile.parent != lastVerifiedParent) {
+					if (!destFile.parent.toRealPath().startsWith(realDestDir)) {
+						throw IllegalStateException("Entry parent escapes the target dir via symlink: ${entry.name}")
+					}
+					lastVerifiedParent = destFile.parent
+				}
+
 				Files.newOutputStream(destFile).use { dest ->
 					zipInput.copyTo(dest)
 				}

app/src/test/java/com/itsaky/androidide/assets/AssetsInstallationHelperTest.kt

@@ -7,11 +7,17 @@ import io.mockk.every
 import io.mockk.mockk
 import io.mockk.mockkObject
 import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
 import java.io.FileNotFoundException
+import java.nio.file.Files
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
 
 class AssetsInstallationHelperTest {
 	private val ctx: Context = mockk(relaxed = true)
@@ -48,4 +54,30 @@ class AssetsInstallationHelperTest {
 				(failure.cause?.cause) is FileNotFoundException,
 			)
 		}
+
+	@Test
+	fun `extractZipToDir creates parent directories for nested entries with no directory entries`() {
+		val destDir = Files.createTempDirectory("extract-zip-to-dir-test")
+		try {
+			val content = "test notice content"
+			val zipBytes =
+				ByteArrayOutputStream().use { baos ->
+					ZipOutputStream(baos).use { zos ->
+						// No directory entries, matching how android-sdk.zip is packaged.
+						zos.putNextEntry(ZipEntry("build-tools/35.0.0/NOTICE.txt"))
+						zos.write(content.toByteArray())
+						zos.closeEntry()
+					}
+					baos.toByteArray()
+				}
+
+			AssetsInstallationHelper.extractZipToDir(ByteArrayInputStream(zipBytes), destDir)
+
+			val extracted = destDir.resolve("build-tools/35.0.0/NOTICE.txt")
+			assertTrue("Expected extracted file to exist", Files.exists(extracted))
+			assertEquals(content, String(Files.readAllBytes(extracted)))
+		} finally {
+			destDir.toFile().deleteRecursively()
+		}
+	}
 }

app/src/test/java/com/itsaky/androidide/assets/ExtractZipToDirMergeTest.kt

@@ -63,11 +63,72 @@ class ExtractZipToDirMergeTest {
 		)
 	}
 
+	@Test
+	fun `extracts multiple sibling files under the same directory`() {
+		val dest = Files.createTempDirectory("mvn")
+
+		AssetsInstallationHelper.extractZipToDir(
+			zipOf(
+				"com/foo/1.0/a.txt" to "a",
+				"com/foo/1.0/b.txt" to "b",
+			),
+			dest,
+		)
+
+		assertEquals("a", String(Files.readAllBytes(dest.resolve("com/foo/1.0/a.txt"))))
+		assertEquals("b", String(Files.readAllBytes(dest.resolve("com/foo/1.0/b.txt"))))
+	}
+
 	@Test
 	fun `rejects path traversal`() {
 		val dest = Files.createTempDirectory("mvn")
 		assertThrows(IllegalStateException::class.java) {
 			AssetsInstallationHelper.extractZipToDir(zipOf("../evil.jar" to "x"), dest)
 		}
 	}
+
+	@Test
+	fun `rejects extraction over an existing symlink`() {
+		val dest = Files.createTempDirectory("mvn")
+		val outsideTarget = Files.createTempDirectory("outside").resolve("payload")
+
+		Files.createSymbolicLink(dest.resolve("evil.jar"), outsideTarget)
+
+		assertThrows(IllegalStateException::class.java) {
+			AssetsInstallationHelper.extractZipToDir(zipOf("evil.jar" to "x"), dest)
+		}
+	}
+
+	@Test
+	fun `rejects extraction into a symlinked parent that escapes destDir`() {
+		val dest = Files.createTempDirectory("mvn")
+		val outside = Files.createTempDirectory("outside")
+
+		Files.createSymbolicLink(dest.resolve("linked"), outside)
+
+		assertThrows(IllegalStateException::class.java) {
+			AssetsInstallationHelper.extractZipToDir(zipOf("linked/nested.txt" to "x"), dest)
+		}
+	}
+
+	@Test
+	fun `rejects a bare directory entry that resolves to an existing symlink escaping destDir`() {
+		val dest = Files.createTempDirectory("mvn")
+		val outside = Files.createTempDirectory("outside")
+
+		Files.createSymbolicLink(dest.resolve("linked"), outside)
+
+		val zipBytes =
+			ByteArrayOutputStream().use { baos ->
+				ZipOutputStream(baos).use { zip ->
+					zip.putNextEntry(ZipEntry("linked/"))
+					zip.closeEntry()
+				}
+				baos.toByteArray()
+			}
+
+		assertThrows(IllegalStateException::class.java) {
+			AssetsInstallationHelper.extractZipToDir(ByteArrayInputStream(zipBytes), dest)
+		}
+	}
 }