DD-1459 Fix uncontrolled data used in path expression - Test 1A

src/main/java/nl/knaw/dans/ingest/core/AbstractIngestArea.java

@@ -80,4 +80,11 @@ protected void initOutbox(Path outbox, boolean allowNonEmpty) {
             throw new IllegalArgumentException("cannot initialize outbox for batch at " + outbox, e);
         }
     }
+
+    public void checkBaseFolderSecurity(Path path) throws RuntimeException {
+        Path toCheckPath = path.normalize().toAbsolutePath();
+        if (!toCheckPath.startsWith(this.inboxDir)) {
+            throw new IllegalArgumentException(String.format("InsecurePath %s", toCheckPath));
+        }
+    }
 }

src/main/java/nl/knaw/dans/ingest/resources/ImportsResource.java

@@ -47,6 +47,7 @@ public Response startImport(StartImport start) {
         log.debug("Received command = {}", start);
         String batchName;
         try {
+            importArea.checkBaseFolderSecurity(start.getInputPath());
             batchName = importArea.startImport(start.getInputPath(), start.isBatch(), start.isContinue());
         }
         catch (IllegalArgumentException e) {