private boolean unzipPlugin( String pluginName, Path file, Path dir )
        {
            try ( ZipFile zipFile = new JarFile( file.toFile() ) )
            {
                // Ensure that this JAR is a plugin.
                if ( zipFile.getEntry( "plugin.xml" ) == null )
                {
                    return false;
                }

                // Protect against zip-slip (before applying any file-system modifications).
                if ( JiveGlobals.getBooleanProperty( "plugins.loading.zipslipDetection.enabled", true ) )
                {
                    for (Enumeration<? extends ZipEntry> e = zipFile.entries(); e.hasMoreElements(); )
                    {
                        JarEntry entry = (JarEntry) e.nextElement();
                        Path entryFile = dir.resolve( entry.getName() );
                        if ( !entryFile.normalize().toAbsolutePath().startsWith( dir.normalize().toAbsolutePath() ) )
                        {
                            throw new RuntimeException( "Plugin contains content that is outside of target plugin directory (possible zipslip attack)" );
                        }
                    }
                }

                Files.createDirectory( dir );
                // OF-1973: Prevent future-timestamped jar files from restarting the installation process.
                if ( Files.getLastModifiedTime( file ).toMillis() > System.currentTimeMillis() )
                {
                    final FileTime now = FileTime.fromMillis(System.currentTimeMillis());
                    Files.setLastModifiedTime(file, now);
                }
                // Set the date of the JAR file to the newly created folder
                Files.setLastModifiedTime( dir, Files.getLastModifiedTime( file ) );
                Log.debug( "Extracting plugin '{}'...", pluginName );
                for ( Enumeration<? extends ZipEntry> e = zipFile.entries(); e.hasMoreElements(); )
                {
                    JarEntry entry = (JarEntry) e.nextElement();
                    Path entryFile = dir.resolve( entry.getName() ); /* lgtm[java/zipslip] */
                    // The line above ignores LGTM alert for ZipSlip as this is sanitized for if property is enabled.

                    // Ignore any manifest.mf entries.
                    if ( entry.getName().toLowerCase().endsWith( "manifest.mf" ) )
                    {
                        continue;
                    }
                    if ( !entry.isDirectory() )
                    {
                        Files.createDirectories( entryFile.getParent() );
                        try ( InputStream zin = zipFile.getInputStream( entry ) )
                        {
                            Files.copy( zin, entryFile, StandardCopyOption.REPLACE_EXISTING );
                        }
                    }
                }
                Log.debug( "Successfully extracted plugin '{}'.", pluginName );
                return true;
            }
            catch ( Exception e )
            {
                Log.error( "An exception occurred while trying to extract plugin '{}':", pluginName, e );
                return false;
            }
        }
Unzips a plugin from a JAR file into a directory. If the JAR file
isn't a plugin, this method will do nothing.

@param pluginName the name of the plugin.
@param file       the JAR file
@param dir        the directory to extract the plugin to.
@return A boolean indicating success.
xmppserver/src/main/java/org/jivesoftware/openfire/container/PluginMonitor.java