change stripAbsolutePathSpec's default, credit Snyk

WHATSNEW

@@ -9,10 +9,12 @@ Changes that could break older environments:
    destination directory anymore by default. A new attribute
    allowFilesToEscapeDest can be used to override the behavior.
    Another special case is when stripAbsolutePathSpec is false (which
-   still is the default) and the entry's name starts with a
+   no longer is the default) and the entry's name starts with a
    (back)slash and allowFilesToEscapeDest hasn't been specified
    explicitly, in this case the file may be created outside of the
    dest directory as well.
+   In addition stripAbsolutePathSpec is now true by default.
+   Based on a recommendation by the Snyk Security Research Team.
 
 Fixed bugs:
 -----------

manual/Tasks/unzip.html

@@ -126,7 +126,8 @@ archive.</p>
       Note that this changes the entry's name before applying
       include/exclude patterns and before using the nested mappers (if
       any).  <em>since Ant 1.8.0</em></td>
-    <td valign="top" align="center">No, defaults to false</td>
+    <td valign="top" align="center">No, defaults to true since 1.9.12
+      (used to defaukt to false prior to that)</td>
   </tr>
   <tr>
     <td valign="top">scanForUnicodeExtraFields</td>

src/main/org/apache/tools/ant/taskdefs/Expand.java

@@ -67,7 +67,7 @@ public class Expand extends Task {
     private Union resources = new Union();
     private boolean resourcesSpecified = false;
     private boolean failOnEmptyArchive = false;
-    private boolean stripAbsolutePathSpec = false;
+    private boolean stripAbsolutePathSpec = true;
     private boolean scanForUnicodeExtraFields = true;
     private Boolean allowFilesToEscapeDest = null;
 

src/tests/antunit/taskdefs/unzip-test.xml

@@ -101,16 +101,16 @@ public class A {
     <available property="can-write-to-tmp!" file="/tmp/testdir/"/>
   </target>
 
-  <target name="testEntriesCanEscapeDestViaAbsolutePathByDefault"
+  <target name="testEntriesCanEscapeDestViaAbsolutePathIfPermitted"
           depends="-can-write-to-tmp?" if="can-write-to-tmp!">
-    <unzip src="zip/direscape-absolute.zip" dest="${output}"/>
+    <unzip src="zip/direscape-absolute.zip" dest="${output}"
+           stripAbsolutePathSpec="false"/>
     <au:assertFileExists file="/tmp/testdir/a"/>
   </target>
 
-  <target name="testEntriesDontEscapeDestViaAbsolutePathIfProhibited"
+  <target name="testEntriesDontEscapeDestViaAbsolutePathByDefault"
           depends="-can-write-to-tmp?" if="can-write-to-tmp!">
-    <unzip src="zip/direscape-absolute.zip" dest="${output}"
-           allowFilesToEscapeDest="false"/>
+    <unzip src="zip/direscape-absolute.zip" dest="${output}"/>
     <au:assertFileDoesntExist file="/tmp/testdir/a"/>
   </target>
 </project>