[Fix] add resource full name check

[caishunfeng]

Purpose of the pull request

Add the resource full name check during resource operations to avoid illegal paths.

Brief change log

dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java

private void checkFullName(String baseDir, String fullName) {
        if (StringUtils.isNotBlank(fullName) && !StringUtils.startsWith(fullName, baseDir)) {
            throw new ServiceException("Resource file: " + fullName + " is illegal");
        }
    }

Verify this pull request

• Manually verified the change by testing locally.

[caishunfeng]

• [Bug] Fix can modify file which is not under resource path #15652

[ruanwenjun]

Will the resTenantCode be empty?

[caishunfeng]

Yes, when resource create or upload, the resource tenant code is empty. But the better way is to remove checking if not need. I will update it.

dolphinscheduler/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java

Line 130 in dcc9d64

if (!isUserTenantValid(isAdmin(loginUser), tenantCode, "")) {

[caishunfeng]

Resource tenant code will be empty when query resources list, so I keep the logic.

[ruanwenjun]

OK

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 78.57143% with 6 lines in your changes are missing coverage. Please review.

Project coverage is 39.09%. Comparing base (dcc9d64) to head (726ecb0).

❗ Current head 726ecb0 differs from pull request most recent head 52c5dca. Consider uploading reports for the commit 52c5dca to get more accurate results

Files	Patch %	Lines
...heduler/api/service/impl/ResourcesServiceImpl.java	78.57%	5 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                dev   #15757      +/-   ##
============================================
- Coverage     39.10%   39.09%   -0.02%     
+ Complexity     4855     4850       -5     
============================================
  Files          1316     1316              
  Lines         44962    44936      -26     
  Branches       4808     4797      -11     
============================================
- Hits          17583    17567      -16     
  Misses        25478    25478              
+ Partials       1901     1891      -10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sonarcloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
79.5% Coverage on New Code
5.8% Duplication on New Code

See analysis details on SonarCloud

[ruanwenjun]

LGTM