Respond with 404 for invalid file references

[labkey-tchad]

Rationale

Introduce InvalidPathReferenceException to signify a path we don't want to handle, either because it has invalid characters or it's trying to escape its parent.

The link crawler found this error when running on Windows due to the file system rejecting certain characters via File.toPath. Similar errors can be reproduced on Mac/Linux by attempting to reference a parent path (/home/specimen-importSpecimenData.view?path=..)

Stacktrace (Windows)

java.nio.file.InvalidPathException: Illegal char <"> at index 84: D:\teamcity\work\cdd6dd8a02f96780\server\testAutomation\data\studies\Study001\study\">'>'"<\script><img src="x" onerror="alert('8(')">
	at java.base/sun.nio.fs.WindowsPathParser.normalize(WindowsPathParser.java:182)
	at java.base/sun.nio.fs.WindowsPathParser.parse(WindowsPathParser.java:153)
	at java.base/sun.nio.fs.WindowsPathParser.parse(WindowsPathParser.java:77)
	at java.base/sun.nio.fs.WindowsPath.parse(WindowsPath.java:92)
	at java.base/sun.nio.fs.WindowsFileSystem.getPath(WindowsFileSystem.java:232)
	at java.base/java.io.File.toPath(File.java:2387)
	at org.labkey.api.util.FileUtil.appendPath(FileUtil.java:832)
	at org.labkey.pipeline.api.PipeRootImpl._resolveRoot(PipeRootImpl.java:402)
	at org.labkey.pipeline.api.PipeRootImpl.resolvePath(PipeRootImpl.java:375)
	at org.labkey.pipeline.api.PipeRootImpl.resolvePath(PipeRootImpl.java:368)
	at org.labkey.api.pipeline.browse.PipelinePathForm.getValidatedFiles(PipelinePathForm.java:103)
	at org.labkey.api.pipeline.browse.PipelinePathForm.getValidatedFiles(PipelinePathForm.java:96)
	at org.labkey.specimen.actions.SpecimenController$ImportSpecimenDataAction.getView(SpecimenController.java:1086)

Stacktrace (Mac)

java.nio.file.InvalidPathException: Path to parent not allowed: ../path
	at org.labkey.api.util.FileUtil.appendPath(FileUtil.java:829)
	at org.labkey.pipeline.api.PipeRootImpl._resolveRoot(PipeRootImpl.java:402)
	at org.labkey.pipeline.api.PipeRootImpl.resolvePath(PipeRootImpl.java:375)
	at org.labkey.pipeline.api.PipeRootImpl.resolvePath(PipeRootImpl.java:368)
	at org.labkey.api.pipeline.browse.PipelinePathForm.getValidatedFiles(PipelinePathForm.java:103)
	at org.labkey.api.pipeline.browse.PipelinePathForm.getValidatedFiles(PipelinePathForm.java:96)
	at org.labkey.specimen.actions.SpecimenController$ImportSpecimenDataAction.getView(SpecimenController.java:1086)
	at org.labkey.specimen.actions.SpecimenController$ImportSpecimenDataAction.getView(SpecimenController.java:1078)

Related Pull Requests

• N/A

Changes

• Introduce InvalidPathReferenceException
• Report as a 404 with special logging
• Update PipeRoot JavaDoc

[labkey-jeckels]

I've added similar try/catch in a few places too. I wonder if we should automatically treat InvalidPathException -> NotFoundException more centrally, like in ExceptionUtil. It's a runtime exception so it's going to be hard to figure out all the places try/catch might be needed. @labkey-matthewb any opinions?

[labkey-matthewb]

I've added similar try/catch in a few places too. I wonder if we should automatically treat InvalidPathException -> NotFoundException more centrally, like in ExceptionUtil. It's a runtime exception so it's going to be hard to figure out all the places try/catch might be needed. @labkey-matthewb any opinions?

Not really, I guess internally they are different (still not sure we care), but I don't have an opinion about consolidating how we report errors via APIs. If reporting fewer exceptions is better (or more consistent across OS) that seems fine.

[labkey-jeckels]

New approach pushed. @labkey-tchad @labkey-matthewb take a look at your convenience.

[labkey-jeckels]

@labkey-tchad I'll go ahead and self-approve. Please take a look before merging