Improper limitation of a pathname to a restricted directory ('Path Traversal')

// These helpers work on the string, so a NUL escape or a `..` segment survives them and the
// name the filesystem finally sees is not the one that was checked.
object UploadNameChecks {
  @throws[IOException]
  def demonstrate(): Unit = {
    inspect("/uploads%00/././../../././private/keys.cfg" + "\u0000" + "avatar.jpg")
  }

  @throws[IOException]
  private def inspect(supplied: String): Unit = {
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    val normalised = normalize(supplied)
    System.out.println("checked:" + normalised + " actual:" + resolve(normalised))
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    val suffix = getExtension(supplied)
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    System.out.println("checked:" + suffix + " actual:" + getExtension(resolve(normalised)))
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    val looksLikeAnImage = isExtension(supplied, "jpg")
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    System.out.println("checked:" + looksLikeAnImage + " actual:" + isExtension(resolve(normalised), "jpg"))
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    val leaf = getName(supplied)
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    System.out.println("checked:" + leaf + " actual:" + getName(resolve(leaf)))
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    val stem = getBaseName(supplied)
    // VULNERABLE: Improper limitation of a pathname to a restricted directory ('Path Traversal')
    System.out.println("checked:" + stem + " actual:" + getBaseName(resolve(stem)))
  }

  @throws[IOException]
  private def resolve(path: String) = new File(path).getCanonicalPath
}