wolfboys opened a new pull request, #4466: URL: https://github.com/apache/streampark/pull/4466
## What changes are in this PR? This PR tightens input handling on a few project/application endpoints so that the resolved file path is always confined to the expected project directory. ### 1. Refactor: extract `PathUtils` (`72ef4919a`) Move the `isDescendantPath` / `isDirectChildPath` canonical-path checks out of `ApplicationServiceImpl` (where they were `private`) into a shared `base/util/PathUtils` class so the same logic can be reused. Pure refactor, no behavior change. ### 2. Improve: validate module name (`6b8d60f90`) - `ProjectServiceImpl.jars()` / `listConf()` / `getAppConfPath()`: validate the `module` name (reject blank values, path separators, and non-direct-child paths) before resolving it under the project distribution home, via the new `resolveModuleDir` helper that reuses `PathUtils`. - `listConf`: the validation now runs **before** the file-operation `try` block so an invalid name is rejected explicitly instead of being swallowed by the catch. - `ApplicationController`: remove the unused `checkjar` endpoint that had no callers. - Add `ProjectServiceImplTest` covering module-name validation (relative-path rejection, separator rejection, valid-name acceptance). ## How was it tested? - `./mvnw -pl streampark-console/streampark-console-service -am test -Dtest=MybatisPagerTest,ApplicationServiceImplTest,ProjectServiceImplTest` - All 15 tests pass (`ProjectServiceImplTest` 7 + `ApplicationServiceImplTest` 6 + `MybatisPagerTest` 2). - `spotless:apply` clean, checkstyle 0 violations. ## Checklist - [x] Code follows the project's style (spotless + checkstyle clean) - [x] Added/updated tests - [x] Tests pass locally -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
