DD-1459 Fix uncontrolled data used in path expression

src/main/java/nl/knaw/dans/ingest/core/ImportArea.java

@@ -30,7 +30,6 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.List;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 public class ImportArea extends AbstractIngestArea {
@@ -86,7 +85,7 @@ public String startImport(Path inputPath, boolean isBatch, boolean continuePrevi
     private void validateBatchDirectory(Path input) {
         if (Files.isDirectory(input)) {
             try (Stream<Path> subPaths = Files.list(input)) {
-                List<Path> paths = subPaths.collect(Collectors.toList());
+                List<Path> paths = subPaths.toList();
                 for (Path f : paths) {
                     validateDepositDirectory(f);
                 }
@@ -108,4 +107,12 @@ private void validateDepositDirectory(Path input) {
             throw new IllegalArgumentException(String.format("Directory %s does not contain file deposit.properties. Not a valid deposit directory", input));
         }
     }
+
+    public Path getSecurePath(Path path) throws RuntimeException {
+        Path normalizedPath = path.normalize().toAbsolutePath();
+        if (!normalizedPath.startsWith(this.inboxDir)) {
+            throw new IllegalArgumentException(String.format("InsecurePath %s", normalizedPath));
+        }
+        return normalizedPath;
+    }
 }

src/main/java/nl/knaw/dans/ingest/resources/ImportsResource.java

@@ -47,7 +47,8 @@ public Response startImport(StartImport start) {
         log.debug("Received command = {}", start);
         String batchName;
         try {
-            batchName = importArea.startImport(start.getInputPath(), start.isBatch(), start.isContinue());
+            java.nio.file.Path securePath = importArea.getSecurePath(start.getInputPath());
+            batchName = importArea.startImport(securePath, start.isBatch(), start.isContinue());
         }
         catch (IllegalArgumentException e) {
             throw new BadRequestException(e.getMessage());

src/main/java/nl/knaw/dans/ingest/resources/MigrationsResource.java

@@ -47,7 +47,8 @@ public Response startImport(StartImport start) {
         log.info("Received command = {}", start);
         String taskName;
         try {
-            taskName = migrationArea.startImport(start.getInputPath(), start.isBatch(), start.isContinue());
+            java.nio.file.Path securePath = migrationArea.getSecurePath(start.getInputPath());
+            taskName = migrationArea.startImport(securePath, start.isBatch(), start.isContinue());
         }
         catch (IllegalArgumentException e) {
             throw new BadRequestException(e.getMessage());