Fix path attack when loading snapshot of IoTConsensus (#16098)

(cherry picked from commit f907bd3)

Author: jt2594838

iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/IoTConsensusServerImpl.java

@@ -358,7 +358,7 @@ public void receiveSnapshotFragment(
       throws ConsensusGroupModifyPeerException {
     try {
       String targetFilePath = calculateSnapshotPath(snapshotId, originalFilePath);
-      File targetFile = new File(storageDir, targetFilePath);
+      File targetFile = getSnapshotPath(targetFilePath);
       Path parentDir = Paths.get(targetFile.getParent());
       if (!Files.exists(parentDir)) {
         Files.createDirectories(parentDir);
@@ -405,7 +405,23 @@ private void clearOldSnapshot() {
 
   public void loadSnapshot(String snapshotId) {
     // TODO: (xingtanzjr) throw exception if the snapshot load failed
-    stateMachine.loadSnapshot(new File(storageDir, snapshotId));
+    stateMachine.loadSnapshot(getSnapshotPath(snapshotId));
+  }
+
+  private File getSnapshotPath(String snapshotRelativePath) {
+    File storageDirFile = new File(storageDir);
+    File snapshotDir = new File(storageDir, snapshotRelativePath);
+    try {
+      if (!snapshotDir
+          .getCanonicalFile()
+          .toPath()
+          .startsWith(storageDirFile.getCanonicalFile().toPath())) {
+        throw new IllegalArgumentException("Invalid snapshotRelativePath: " + snapshotRelativePath);
+      }
+    } catch (IOException e) {
+      throw new IllegalArgumentException(e);
+    }
+    return snapshotDir;
   }
 
   @FunctionalInterface
@@ -816,7 +832,7 @@ public void cleanupRemoteSnapshot(Peer targetPeer) throws ConsensusGroupModifyPe
   }
 
   public void cleanupSnapshot(String snapshotId) throws ConsensusGroupModifyPeerException {
-    File snapshotDir = new File(storageDir, snapshotId);
+    File snapshotDir = getSnapshotPath(snapshotId);
     if (snapshotDir.exists()) {
       try {
         FileUtils.deleteDirectory(snapshotDir);