Path Traversal in Java (java.nio.file, Spring)

// FileController.java: flat names opened relative to a held directory handle
package com.example.files;

import java.io.FilterInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.ByteBuffer;
import java.nio.channels.Channels;
import java.nio.channels.SeekableByteChannel;
import java.nio.file.DirectoryStream;
import java.nio.file.Files;
import java.nio.file.LinkOption;
import java.nio.file.Path;
import java.nio.file.SecureDirectoryStream;
import java.nio.file.StandardOpenOption;
import java.util.Set;
import java.util.regex.Pattern;
import java.util.UUID;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;
import org.springframework.core.io.InputStreamResource;
import org.springframework.core.io.Resource;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.server.ResponseStatusException;

@RestController
public class FileController {
    private static final Path UPLOAD_DIR = Path.of("/srv/uploads").toAbsolutePath().normalize();
    private static final int MAX_ENTRY_BYTES = 1_048_576;
    private static final int MAX_TOTAL_BYTES = 100_000_000;
    private static final int MAX_ENTRIES = 1000;
    private static final long MAX_ARCHIVE_BYTES = 100_000_000L;
    private static final Pattern SERVER_NAME = Pattern.compile("[A-Za-z0-9_-]{1,80}");

    // This example uses a flat store: reject paths and accept one server-generated name.
    static Path flatName(String raw) {
        Path name = Path.of(raw);
        if (!SERVER_NAME.matcher(raw).matches() || raw.contains("/") || raw.contains("\\") || name.isAbsolute()
                || name.getNameCount() != 1) {
            throw new IllegalArgumentException("expected one file name");
        }
        return name;
    }

    // Some providers do not support race-resistant relative operations; fail closed.
    @SuppressWarnings("unchecked")
    static SecureDirectoryStream<Path> secureRoot(Path directory) throws IOException {
        DirectoryStream<Path> stream = Files.newDirectoryStream(directory);
        if (!(stream instanceof SecureDirectoryStream<?>)) {
            stream.close();
            throw new IOException("SecureDirectoryStream is required");
        }
        return (SecureDirectoryStream<Path>) stream;
    }

    // Open the leaf relative to the held root; keep that handle alive through the read.
    static InputStream openInside(Path directory, String rawName) throws IOException {
        Path name = flatName(rawName);
        SecureDirectoryStream<Path> root = secureRoot(directory);
        SeekableByteChannel channel;
        try {
            channel = root.newByteChannel(name,
                    Set.of(StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS));
        } catch (IOException | RuntimeException e) {
            root.close();
            throw e;
        }
        return new FilterInputStream(Channels.newInputStream(channel)) {
            @Override public void close() throws IOException {
                try { super.close(); } finally { root.close(); }
            }
        };
    }

    @GetMapping("/download")
    public Resource download(@RequestParam String file) {
        try {
            return new InputStreamResource(openInside(UPLOAD_DIR, file));
        } catch (IOException | IllegalArgumentException e) {
            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "not found", e);
        }
    }

    @GetMapping("/preview")
    public String preview(@RequestParam String file) throws IOException {
        try (InputStream in = openInside(UPLOAD_DIR, file)) {
            return new String(in.readNBytes(2000), java.nio.charset.StandardCharsets.UTF_8);
        } catch (IllegalArgumentException e) {
            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "not found", e);
        }
    }

    // Validate the archive label, but never use it as a filesystem output name.
    static void validateFlatEntry(String raw) {
        Path entry = Path.of(raw);
        if (raw.isEmpty() || raw.contains("/") || raw.contains("\\") || entry.isAbsolute()
                || entry.getNameCount() != 1 || raw.equals(".") || raw.equals("..")) {
            throw new IllegalArgumentException("expected one flat archive entry");
        }
    }

    // Stop compressed-input growth too; exact-limit archives are accepted, larger ones fail.
    static InputStream limitArchive(InputStream source) {
        return new FilterInputStream(source) {
            private long remaining = MAX_ARCHIVE_BYTES;
            @Override public int read() throws IOException {
                if (remaining == 0) {
                    if (super.read() == -1) return -1;
                    throw new IOException("archive input too large");
                }
                int value = super.read();
                if (value != -1) remaining--;
                return value;
            }
            @Override public int read(byte[] bytes, int offset, int length) throws IOException {
                if (length == 0) return 0;
                if (remaining == 0) {
                    if (super.read() == -1) return -1;
                    throw new IOException("archive input too large");
                }
                int count = super.read(bytes, offset, (int) Math.min(length, remaining));
                if (count > 0) remaining -= count;
                return count;
            }
        };
    }

    // This flat archive example rejects directory and nested-path entries; create new files only.
    public static void importArchive(InputStream in, Path destination) throws IOException {
        try (SecureDirectoryStream<Path> root = secureRoot(destination.toAbsolutePath().normalize());
             ZipInputStream zip = new ZipInputStream(limitArchive(in))) {
            int entries = 0;
            int totalBytes = 0;
            for (ZipEntry entry; (entry = zip.getNextEntry()) != null; ) {
                if (++entries > MAX_ENTRIES) throw new IOException("too many archive entries");
                if (entry.isDirectory()) throw new IOException("directory entries are not accepted");
                try { validateFlatEntry(entry.getName()); }
                catch (IllegalArgumentException e) { throw new IOException("unsafe archive entry", e); }
                Path name = Path.of(UUID.randomUUID().toString());
                byte[] contents = zip.readNBytes(MAX_ENTRY_BYTES + 1);
                if (contents.length > MAX_ENTRY_BYTES) throw new IOException("archive entry too large");
                if (contents.length > MAX_TOTAL_BYTES - totalBytes) throw new IOException("archive too large");
                totalBytes += contents.length;
                try (SeekableByteChannel channel = root.newByteChannel(name,
                        Set.of(StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE,
                               LinkOption.NOFOLLOW_LINKS))) {
                    Channels.newOutputStream(channel).write(contents);
                }
            }
        }
    }
}