Cod sample for partial path traversal

Author: fugerit79

code-samples-base/src/test/java/test/org/fugerit/java/code/samples/vulnerability/TestPartialPathTraversal.java

@@ -0,0 +1,54 @@
+package test.org.fugerit.java.code.samples.vulnerability;
+
+import lombok.extern.slf4j.Slf4j;
+import org.fugerit.java.core.function.SafeFunction;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.function.BiFunction;
+
+/**
+ *
+ * This sample is based on the CodeQUL code scanning alert :
+ * https://github.com/fugerit-org/fj-doc/security/code-scanning/103
+ *
+ */
+@Slf4j
+class TestPartialPathTraversal {
+
+    private static final BiFunction<File, File, Boolean> CANONICAL_PATH_FUN =
+            ( dir, parent ) -> SafeFunction.get( () -> dir.getCanonicalPath().startsWith( parent.getCanonicalPath() ) );
+
+    private static final BiFunction<File, File, Boolean> NORMALIZED_PATH_FUN =
+            ( dir, parent ) -> SafeFunction.get( () -> dir.toPath().normalize().startsWith( parent.toPath().normalize() ) );
+
+    private boolean checkWorker( File dir, File parent, BiFunction<File, File, Boolean> fun, String desc ) throws IOException {
+        boolean allowCheck = fun.apply( dir, parent );
+        log.info( "checkWorker result : {}, dir : {}, parent : {}, desc : {}", allowCheck, dir.getCanonicalPath(), parent.getCanonicalPath(), desc );
+        return allowCheck;
+    }
+
+    @Test
+    void testAllowCheck() throws IOException {
+        File dir = new File( "./src/test/resources/partial-path-traversal/dir1" );
+        File dir1v = new File( "./src/test/resources/partial-path-traversal/dir1vulnerable" );
+        File dir1s = new File( "./src/test/resources/partial-path-traversal/dir1/subdir" );
+        File dir1u = new File( "./src/test/resources/partial-path-traversal/dir2" );
+        // CANONICAL_PATH_FUN will wrongly allow to use directory on the same level of allowed directory if substring
+        Assertions.assertTrue( this.checkWorker( dir1v, dir, CANONICAL_PATH_FUN, "canonical path vulnerable" ) );
+        // CANONICAL_PATH_FUN will correctly allow a subdir
+        Assertions.assertTrue( this.checkWorker( dir1s, dir, CANONICAL_PATH_FUN, "canonical path real subdir" ) );
+        // CANONICAL_PATH_FUN will correctly stop an unrelated dir
+        Assertions.assertFalse( this.checkWorker( dir1u, dir, CANONICAL_PATH_FUN, "canonical path real subdir" ) );
+        // NORMALIZED_PATH_FUN will correctly stop this
+        Assertions.assertFalse( this.checkWorker( dir1v, dir, NORMALIZED_PATH_FUN, "normalized path vulnerable" ) );
+        // NORMALIZED_PATH_FUN will correctly allow subdir
+        Assertions.assertTrue( this.checkWorker( dir1s, dir, NORMALIZED_PATH_FUN, "normalized path real subdir" ) );
+        // NORMALIZED_PATH_FUN will correctly stop unrelated dir
+        Assertions.assertFalse( this.checkWorker( dir1u, dir, NORMALIZED_PATH_FUN, "normalized path real subdir" ) );
+
+    }
+
+}