public class

PathUtils

extends Object
java.lang.Object
   ↳ com.atlassian.jira.util.PathUtils

Class Overview

This class contains utility methods for manipulating paths.

Summary

Public Methods
static String appendFileSeparator(String filePath)
static void ensurePathInSecureDir(String secureDir, String untrustedPath)
Checks if using untrustedPath would result in path traversal.
static boolean isPathInSecureDir(String secureDir, String untrustedPath)
Checks if using untrustedPath would result in path traversal.
static String joinPaths(String... paths)
[Expand]
Inherited Methods
From class java.lang.Object

Public Methods

public static String appendFileSeparator (String filePath)

public static void ensurePathInSecureDir (String secureDir, String untrustedPath)

Checks if using untrustedPath would result in path traversal. We consider that a path traversal occurs if the file or directory refered to in untrustedPath is not contained in secureDir. This method uses the technique described in IDS02-J in the CERT Secure Coding Standard.

Note that secureDir is assumed to be secure, so this parameter must never contain user-supplied input.

Parameters
secureDir a String containing the path to a "secure" base directory
untrustedPath a String containing a path that was built using user-supplied input (relative or absolute)
Throws
PathTraversalException if untrustedPath is not below secureDir
IOException if there is an I/O problem calling java.io.File.getCanonicalPath()

public static boolean isPathInSecureDir (String secureDir, String untrustedPath)

Checks if using untrustedPath would result in path traversal. We consider that a path traversal occurs if the file or directory refered to in untrustedPath is not contained in secureDir. This method uses the technique described in IDS02-J in the CERT Secure Coding Standard.

Note that secureDir is assumed to be secure, so this parameter must never contain user-supplied input.

Parameters
secureDir a String containing the path to a "secure" base directory
untrustedPath a String containing a path that was built using user-supplied input (relative or absolute)
Returns
  • a boolean indicating whether untrustedPath in secureDir
Throws
IOException if there is an I/O problem calling java.io.File.getCanonicalPath()

public static String joinPaths (String... paths)