vuln-fix: Partial Path Traversal Vulnerability

This fixes a partial path traversal vulnerability.

Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.

To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.

Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: Medium
CVSSS: 6.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.PartialPathTraversalVulnerability)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#13


Co-authored-by: Moderne <[email protected]>

core/src/main/java/org/jahia/services/importexport/ImportExportBaseService.java

@@ -232,7 +232,7 @@ public static String updatedServerDirectoryPath(String serverDirectoryPath) thro
             return null;
         }
         File exportPath = new File(serverDirectoryPath);
-        return exportPath.getCanonicalPath().startsWith(SettingsBean.getInstance().getJahiaExportsDiskPath())
+        return exportPath.getCanonicalFile().toPath().startsWith(SettingsBean.getInstance().getJahiaExportsDiskPath())
                 ? exportPath.getCanonicalPath()
                 : new File(SettingsBean.getInstance().getJahiaExportsDiskPath(), serverDirectoryPath).getCanonicalPath();
     }
@@ -266,7 +266,7 @@ public static boolean isDirectoryEmpty(String pathStr) throws IOException {
     public static boolean isValidServerDirectory(String serverDirectory) {
         try {
             File serverDirectoryFile = new File(serverDirectory);
-            if (!serverDirectoryFile.getCanonicalPath().startsWith(EXPORT_PATH.getCanonicalPath())) {
+            if (!serverDirectoryFile.getCanonicalFile().toPath().startsWith(EXPORT_PATH.getCanonicalFile().toPath())) {
                 logger.error("User is trying to export to {} which is outside the allowed location {}",
                         serverDirectory, EXPORT_PATH.getCanonicalPath());
                 return false;
@@ -2023,7 +2023,7 @@ private String validateZipName(String filename) throws java.io.IOException {
         String canonicalPath = new File(filename).getCanonicalPath();
         String canonicalID = new File(".").getCanonicalPath();
 
-        if (canonicalPath.startsWith(canonicalID)) {
+        if (new File(filename).getCanonicalFile().toPath().startsWith(canonicalID)) {
             return canonicalPath.substring(canonicalID.length() + 1);
         } else {
             throw new IllegalStateException("File is outside extraction target directory.");