diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java index 4ea6636e1e..7b0960dbda 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java @@ -36,6 +36,7 @@ import org.jkiss.utils.CommonUtils; import java.io.IOException; import java.nio.file.Files; +import java.nio.file.InvalidPathException; import java.nio.file.NoSuchFileException; import java.nio.file.Path; import java.time.OffsetDateTime; @@ -266,11 +267,15 @@ public class LocalResourceController implements RMController { throw new DBException("Error creating project path", e); } } - Path targetPath = projectPath.resolve(resourcePath).normalize(); - if (!targetPath.startsWith(projectPath)) { - throw new DBException("Invalid resource path"); + try { + Path targetPath = projectPath.resolve(resourcePath).normalize(); + if (!targetPath.startsWith(projectPath)) { + throw new DBException("Invalid resource path"); + } + return targetPath; + } catch (InvalidPathException e) { + throw new DBException("Resource path contains invalid characters"); } - return targetPath; } private RMProject makeProjectFromPath(Path path, String prefix, boolean checkExistence) {