Normalize Paths (#1245)

* Normalize Paths

* Formatting

* Different format

server/src/main/kotlin/suwayomi/tachidesk/graphql/server/TemporaryFileStorage.kt

@@ -11,6 +11,7 @@ import kotlin.concurrent.thread
 import kotlin.io.path.ExperimentalPathApi
 import kotlin.io.path.deleteIfExists
 import kotlin.io.path.deleteRecursively
+import kotlin.io.path.name
 import kotlin.io.path.outputStream
 import kotlin.time.Duration.Companion.days
 
@@ -43,5 +44,11 @@ object TemporaryFileStorage {
         }
     }
 
-    fun retrieveFile(name: String): Path = folder.resolve(name)
+    fun retrieveFile(name: String): Path {
+        val file = folder.resolve(name).normalize()
+        check(file.startsWith(folder)) {
+            "File $name is not in ${folder.name}"
+        }
+        return file
+    }
 }

server/src/main/kotlin/suwayomi/tachidesk/manga/impl/extension/Extension.kt

@@ -48,6 +48,10 @@ import java.io.InputStream
 import java.util.zip.ZipEntry
 import java.util.zip.ZipInputStream
 import java.util.zip.ZipOutputStream
+import kotlin.io.path.Path
+import kotlin.io.path.absolutePathString
+import kotlin.io.path.outputStream
+import kotlin.io.path.relativeTo
 
 object Extension {
     private val logger = KotlinLogging.logger {}
@@ -77,17 +81,20 @@ object Extension {
         apkName: String,
     ): Int =
         installAPK(true) {
-            val savePath = "${applicationDirs.extensionsRoot}/$apkName"
+            val rootPath = Path(applicationDirs.extensionsRoot)
+            val downloadedFile = rootPath.resolve(apkName).normalize()
+            check(downloadedFile.startsWith(rootPath) && downloadedFile.parent == rootPath) {
+                "File '$apkName' is not a valid extension file"
+            }
             logger.debug { "Saving apk at $apkName" }
             // download apk file
-            val downloadedFile = File(savePath)
-            downloadedFile.sink().buffer().use { sink ->
+            downloadedFile.outputStream().sink().buffer().use { sink ->
                 inputStream.source().use { source ->
                     sink.writeAll(source)
                     sink.flush()
                 }
             }
-            savePath
+            downloadedFile.absolutePathString()
         }
 
     suspend fun installAPK(

server/src/main/kotlin/suwayomi/tachidesk/manga/impl/util/PackageTools.kt

@@ -30,6 +30,7 @@ import java.nio.file.Files
 import java.nio.file.Path
 import javax.xml.parsers.DocumentBuilderFactory
 import kotlin.io.path.Path
+import kotlin.io.path.relativeTo
 
 object PackageTools {
     private val logger = KotlinLogging.logger {}
@@ -68,10 +69,11 @@ object PackageTools {
             .skipExceptions(false)
             .to(jarFilePath)
         if (handler.hasException()) {
-            val errorFile: Path = File(applicationDirs.extensionsRoot).toPath().resolve("$fileNameWithoutType-error.txt")
+            val rootPath = Path(applicationDirs.extensionsRoot)
+            val errorFile: Path = rootPath.resolve("$fileNameWithoutType-error.txt")
             logger.error {
                 """
-                Detail Error Information in File $errorFile
+                Detail Error Information in File ${errorFile.relativeTo(rootPath)}
                 Please report this file to one of following link if possible (any one).
                 https://sourceforge.net/p/dex2jar/tickets/
                 https://bitbucket.org/pxb1988/dex2jar/issues

server/src/main/kotlin/suwayomi/tachidesk/server/ServerSetup.kt

@@ -147,7 +147,7 @@ fun applicationSetup() {
                 .replace(Regex("(\"basicAuth(?:Username|Password)\"\\s:\\s)(?!\"\")\".*\""), "$1\"******\"")
     }
 
-    logger.debug("Data Root directory is set to: ${applicationDirs.dataRoot}")
+    logger.debug { "Data Root directory is set to: ${applicationDirs.dataRoot}" }
 
     // Migrate Directories from old versions
     File("$ApplicationRootDir/manga-thumbnails").renameTo(applicationDirs.tempThumbnailCacheRoot)