[HOTFIX] Validate note name (apache#4632)

* [HOTFIX] Validate note name * [HOTFIX] Validate note name * [HOTFIX] Validate note name * Update zeppelin-server/src/test/java/org/apache/zeppelin/service/NotebookServiceTest.java Co-authored-by: Philipp Dallig <philipp.dallig@gmail.com> * Update zeppelin-server/src/main/java/org/apache/zeppelin/service/NotebookService.java Co-authored-by: Philipp Dallig <philipp.dallig@gmail.com> * [HOTFIX] Fix commented --------- Co-authored-by: Philipp Dallig <philipp.dallig@gmail.com>
meta-soul · May 14, 2024 · b82e098 · b82e098
1 parent 02657b7
commit b82e098
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/service/NotebookService.java b/zeppelin-server/src/main/java/org/apache/zeppelin/service/NotebookService.java
@@ -24,6 +24,8 @@
 import static org.apache.zeppelin.scheduler.Job.Status.ABORT;
 
 import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.time.Instant;
@@ -304,6 +306,12 @@ String normalizeNotePath(String notePath) throws IOException {
     }
 
     notePath = notePath.replace("\r", " ").replace("\n", " ");
+
+    notePath = URLDecoder.decode(notePath, StandardCharsets.UTF_8.toString());
+    if (notePath.endsWith("/")) {
+      throw new IOException("Note name shouldn't end with '/'");
+    }
+
     int pos = notePath.lastIndexOf("/");
     if ((notePath.length() - pos) > 255) {
       throw new IOException("Note name must be less than 255");

diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/service/NotebookServiceTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/service/NotebookServiceTest.java
@@ -528,5 +528,17 @@ void testNormalizeNotePath() throws IOException {
     } catch (IOException e) {
       assertEquals("Note name can not contain '..'", e.getMessage());
     }
+    try {
+      notebookService.normalizeNotePath("%2e%2e/%2e%2e/tmp/test222");
+      fail("Should fail");
+    } catch (IOException e) {
+      assertEquals("Note name can not contain '..'", e.getMessage());
+    }
+    try {
+      notebookService.normalizeNotePath("./");
+      fail("Should fail");
+    } catch (IOException e) {
+      assertEquals("Note name shouldn't end with '/'", e.getMessage());
+    }
   }
 }