From e5e77492518a198877171801c1cf484b86f852e3 Mon Sep 17 00:00:00 2001
From: BaiJv <liu3751@foxmail.com>
Date: Fri, 12 Apr 2024 10:06:32 +0800
Subject: [PATCH] [Improvement] Abnormal characters check (#15824)

* abnormal characters check

* add test case

* remove error log

* fix code style

* fix import
---
 .../service/impl/ResourcesServiceImpl.java    |  5 +++++
 .../api/utils/CheckUtils.java                 | 10 ++++++++++
 .../api/utils/CheckUtilsTest.java             | 20 +++++++++++++++++++
 .../common/constants/Constants.java           |  5 +++++
 4 files changed, 40 insertions(+)

diff --git a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java
index 6a15da17a8..1c039cdfbd 100644
--- a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java
+++ b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java
@@ -17,6 +17,7 @@
 
 package org.apache.dolphinscheduler.api.service.impl;
 
+import static org.apache.dolphinscheduler.api.utils.CheckUtils.checkFilePath;
 import static org.apache.dolphinscheduler.common.constants.Constants.ALIAS;
 import static org.apache.dolphinscheduler.common.constants.Constants.CONTENT;
 import static org.apache.dolphinscheduler.common.constants.Constants.EMPTY_STRING;
@@ -1290,6 +1291,10 @@ public class ResourcesServiceImpl extends BaseServiceImpl implements ResourcesSe
         if (FOLDER_SEPARATOR.equalsIgnoreCase(fullName)) {
             return;
         }
+        // abnormal characters check
+        if (!checkFilePath(fullName)) {
+            throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH);
+        }
         // Avoid returning to the parent directory
         if (fullName.contains("../")) {
             throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH, fullName);
diff --git a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/utils/CheckUtils.java b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/utils/CheckUtils.java
index 8b166a16dd..b394d4956c 100644
--- a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/utils/CheckUtils.java
+++ b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/utils/CheckUtils.java
@@ -158,4 +158,14 @@ public class CheckUtils {
 
         return pattern.matcher(str).matches();
     }
+
+    /**
+     * regex FilePath check,only use a to z, A to Z, 0 to 9, and _./- 
+     *
+     * @param str     input string
+     * @return true if regex pattern is right, otherwise return false
+     */
+    public static boolean checkFilePath(String str) {
+        return regexChecks(str, Constants.REGEX_FILE_PATH);
+    }
 }
diff --git a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/utils/CheckUtilsTest.java b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/utils/CheckUtilsTest.java
index bca8a69a16..da5ea88c83 100644
--- a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/utils/CheckUtilsTest.java
+++ b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/utils/CheckUtilsTest.java
@@ -92,4 +92,24 @@ public class CheckUtilsTest {
         Assertions.assertTrue(CheckUtils.checkPhone("17362537263"));
     }
 
+    /**
+     * check file path
+     */
+    @Test
+    public void testCheckFilePath() {
+        // true
+        Assertions.assertTrue(CheckUtils.checkFilePath("/"));
+        Assertions.assertTrue(CheckUtils.checkFilePath("xx/"));
+        Assertions.assertTrue(CheckUtils.checkFilePath("/xx"));
+        Assertions.assertTrue(CheckUtils.checkFilePath("14567134578654"));
+        Assertions.assertTrue(CheckUtils.checkFilePath("/admin/root/"));
+        Assertions.assertTrue(CheckUtils.checkFilePath("/admin/root/1531531..13513/153135.."));
+        // false
+        Assertions.assertFalse(CheckUtils.checkFilePath(null));
+        Assertions.assertFalse(CheckUtils.checkFilePath("file://xxx/ss"));
+        Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss;/dasd/123"));
+        Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss && /dasd/123"));
+        Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss || /dasd/123"));
+    }
+
 }
diff --git a/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/Constants.java b/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/Constants.java
index 054a9410d5..19e1a1fabb 100644
--- a/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/Constants.java
+++ b/dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/Constants.java
@@ -252,6 +252,11 @@ public final class Constants {
      */
     public static final Pattern REGEX_USER_NAME = Pattern.compile("^[a-zA-Z0-9._-]{3,39}$");
 
+    /**
+     * file path regex 
+     */
+    public static final Pattern REGEX_FILE_PATH = Pattern.compile("^[a-zA-Z0-9_./-]+$");
+
     /**
      * read permission
      */