BugFix: potential path traversal vulnerability

java/installer/src/main/java/com/epam/deltix/izpack/panels/timebase/TBHomeSelectionPanel.java

@@ -34,7 +34,8 @@
 import com.izforge.izpack.installer.data.GUIInstallData;
 import com.izforge.izpack.installer.gui.IzPanel;
 import com.izforge.izpack.installer.gui.LayoutHelper;
-
+import java.io.IOException;
+import java.net.URI;
 public class TBHomeSelectionPanel extends JPanel implements ActionListener, LayoutConstants
 {
 
@@ -139,9 +140,41 @@ public void actionPerformed(ActionEvent e)
 
     public String getPath()
     {
+        ensurePathIsRelative(textField.getText());
         return (textField.getText());
     }
 
+    private static void ensurePathIsRelative(String path) {
+        ensurePathIsRelative(new File(path));
+    }
+
+
+    private static void ensurePathIsRelative(URI uri) {
+        ensurePathIsRelative(new File(uri));
+    }
+
+
+    private static void ensurePathIsRelative(File file) {
+        // Based on https://stackoverflow.com/questions/2375903/whats-the-best-way-to-defend-against-a-path-traversal-attack/34658355#34658355
+        String canonicalPath;
+        String absolutePath;
+
+        if (file.isAbsolute()) {
+            throw new RuntimeException("Potential directory traversal attempt - absolute path not allowed");
+        }
+
+        try {
+            canonicalPath = file.getCanonicalPath();
+            absolutePath = file.getAbsolutePath();
+        } catch (IOException e) {
+            throw new RuntimeException("Potential directory traversal attempt", e);
+        }
+
+        if (!canonicalPath.startsWith(absolutePath) || !canonicalPath.equals(absolutePath)) {
+            throw new RuntimeException("Potential directory traversal attempt");
+        }
+    }
+
     public void setPath(String path)
     {
         textField.setText(path);