Improvements:
Use SecureRandom instead of Random to implement a cryptographically strong random number
Bug fixes:
Fix null check
Append file separator to path check only if required
Fix endOfCentralDirectory location calculation when setting comment
Use Path comparison over String comparison for Path traversal vulnerability
Set lastModifiedFileTime for all entries and not just directories
Use charset when generating AES vendor id info