ESB-703 Path Traversal fix - pipeline fixes

.github/workflows/main.yml

@@ -63,7 +63,10 @@ jobs:
           toolchain: stable
           override: true
 
-      - name: Run cargo-tarpaulin
-        uses: actions-rs/tarpaulin@v0.1
-        with:
-          args: '--ignore-tests'
+      # This installs the tarpaulin tool itself.
+      - name: Install cargo-tarpaulin
+        run: cargo install cargo-tarpaulin
+
+      # This runs tarpaulin to generate the coverage report.
+      - name: Run tarpaulin
+        run: cargo tarpaulin --ignore-tests

src/handlers.rs

@@ -82,12 +82,12 @@ pub async fn health_check() -> Result<HttpResponse, Error> {
 /// * file (String): The local path of the file to be uploaded or the stream
 /// * date (u64): The UnixTime in seconds
 /// * path (String): The path where the file should be copied to the CDS server. If the `archives`
-/// value is passed, than a `tar.gz` archive is expected which should be copied inside a specific path
-/// `entando-data/archives/[your-archive].tar.gz`. The `filename` attribute must end with tar.gz if
-/// `archives` is passed as path.
+///   value is passed, than a `tar.gz` archive is expected which should be copied inside a specific path
+///   `entando-data/archives/[your-archive].tar.gz`. The `filename` attribute must end with tar.gz if
+///   `archives` is passed as path.
 /// * is_protected_file (String): Accepted values are (true, false). If the value is `true` than the
-/// file should be copied inside `/entando-data/protected` directory, otherwise to the
-/// `/entando-data/public` one.
+///   file should be copied inside `/entando-data/protected` directory, otherwise to the
+///   `/entando-data/public` one.
 #[derive(Serialize, Deserialize)]
 pub struct FileResource {
     status: String,

src/utils.rs

@@ -129,7 +129,7 @@ fn normalize_path(path: &Path) -> PathBuf {
 }
 
 /// Check if a normalized path starts with a normalized base path
-fn path_starts_with_base(path: &PathBuf, base: &PathBuf) -> bool {
+fn path_starts_with_base(path: &Path, base: &Path) -> bool {
     let path_components: Vec<_> = path.components().collect();
     let base_components: Vec<_> = base.components().collect();