Changed code to not construct the path from user-controlled data.

Issue-ID: VNFSDK-834

Signed-off-by: sharath reddy <bs.reddy@huawei.com>
Change-Id: If9eb5ee546436ed9c4495bac8706883ee1ca98ce
Signed-off-by: sharath reddy <bs.reddy@huawei.com>

1 files changed, 6 insertions, 2 deletions

diff --git a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
index 915cd144..1a8de345 100644
--- a/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
+++ b/vnfmarket-be/vnf-sdk-marketplace/src/main/java/org/onap/vtp/scenario/VTPScenarioResource.java
@@ -431,8 +431,12 @@ public class VTPScenarioResource extends VTPResource{
         }
 
         try {
-            FileUtils.deleteQuietly(new File(VTP_YAML_STORE, scenarioName));
-            FileUtils.deleteDirectory(scenarioDir);
+            if(FileUtils.directoryContains(new File(VTP_YAML_STORE), new File(scenarioName))) {
+                FileUtils.deleteQuietly(new File(VTP_YAML_STORE, scenarioName));
+            }
+            if(FileUtils.directoryContains(new File(VTP_YAML_STORE), scenarioDir)) {
+                FileUtils.deleteDirectory(scenarioDir);
+            }
         } catch (IOException e) {
             LOG.error("Delete scenario yaml {} failed", scenarioName, e);
             throw new VTPException(