chutney-legacy
chutney-legacy copied to clipboard
🚀 | Normalize use of files IO & prevent path traversal
Describe your use case
- There are many places doing file IO. Some are wrapped by com.chutneytesting.tools.file.FileUtils in module tools. But some are not.
- Prevent path traversal
Is your feature request related to a problem ?
No response
Describe the solution you'd like
If possible, wrap everything under FileUtils, add tests for this class and handle path traversal in it.
Most of the time, we know the path in which we are working. So a simple idea to prevent path traversal should be to check the parent path to the expected parent.
Something like
Paths.get(STORE_PATH + File.separator + USER_INPUT_PART).normalize().getParent().equals(Paths.get(STORE_PATH).normalize())
Link to examples
No response