Add Validator for Path Traversal

[gilday]

To prevent path traversal, I need to ensure that a given Path does not escape out of a given directory. Looking for a validator that will make this easy e.g.

public static boolean isParent(Path directory, Path path) { ... }

[nahsra]

I see multiple use cases here that align nicely with some of the issues we just had in our own security advisory.

public static boolean hasEscapeSequences(Path p) -- to confirm that a Path has no escape sequences and can be safely used with Path#resolve() to build a child Path of a directory.

public static boolean isFileWithinDirectory(Path file, Path directory) -- to confirm the given (full) file path is in the given directory.

Does this sound right to you?

[gilday]

Yes, that sounds right to me. My use case is this:

I am processing a response from an external system that I do not trust. This response includes a directory and a list of files that are supposedly in that directory. I want to verify that those files are in fact children of the given directory vs attempts to escape that directory.