Add file path validation

Add file path validation for EnvVarFileResolver.  Refactored
PathValidator to org.onap.ccsdk.sli.core.utils so it can be used here.

Change-Id: Ibb50df0ad020cf376c1ce20e7b598f7ad7223d48
Issue-ID: CCSDK-2918
Signed-off-by: Dan Timoney <dtimoney@att.com>

2 files changed, 18 insertions, 1 deletions

diff --git a/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/EnvVarFileResolver.java b/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/EnvVarFileResolver.java
index 669b3992b..29d35d6ef 100755
--- a/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/EnvVarFileResolver.java
+++ b/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/EnvVarFileResolver.java
@@ -62,7 +62,7 @@ public abstract class EnvVarFileResolver implements PropertiesFileResolver {
         final File fileFromEnvVariable;
         if (!Strings.isNullOrEmpty(propDirectoryFromEnvVariable)) {
             fileFromEnvVariable = Paths.get(propDirectoryFromEnvVariable).resolve(filename).toFile();
-            if(fileFromEnvVariable.exists()) {
+            if(PathValidator.isValidFilePath(fileFromEnvVariable.getAbsolutePath()) && fileFromEnvVariable.exists()) {
                 return Optional.of(fileFromEnvVariable);
             }
         }
diff --git a/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/PathValidator.java b/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/PathValidator.java
new file mode 100644
index 000000000..973525019
--- /dev/null
+++ b/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/PathValidator.java
@@ -0,0 +1,17 @@
+package org.onap.ccsdk.sli.core.utils;
+import java.util.regex.Pattern;
+
+public class PathValidator {
+    public static boolean isValidXmlPath(String path) {
+        Pattern allowList = Pattern.compile("[-\\w/\\/]+\\.xml$");
+        return (allowList.matcher(path).matches());
+    }
+    public static boolean isValidPropertiesPath(String path) {
+        Pattern allowList = Pattern.compile("[-\\w/\\/]+\\.properties$");
+        return (allowList.matcher(path).matches());
+    }
+    public static boolean isValidFilePath(String path) {
+        Pattern allowList = Pattern.compile("[-\\w/\\/]+");
+        return (allowList.matcher(path).matches());
+    }
+}