Fixed: Implement path traversal protection in OutputServices

Author: jacopoc

applications/content/config/ContentUiLabels.xml

@@ -2089,6 +2089,9 @@
         <value xml:lang="zh">生成${contentType}是出错：${errorString}</value>
         <value xml:lang="zh-TW">產生${contentType}時出錯:${errorString}</value>
     </property>
+    <property key="ContentRenderingPathTraversalError">
+        <value xml:lang="en">Rejected output path: "${fileName}" resolves outside the allowed directory "${filePath}"</value>
+    </property>
     <property key="ContentRequiredField">
         <value xml:lang="en">Required field ${requiredField} is missing in simple method call ${resourceDescription}</value>
         <value xml:lang="fr">Le champ requis ${requiredField} est manquant dans l'appel d'une méthode simple : ${resourceDescription}</value>

applications/content/src/main/java/org/apache/ofbiz/content/output/OutputServices.java

@@ -218,7 +218,7 @@ public static Map<String, Object> createFileFromScreen(DispatchContext dctx, Map
         Map<String, Object> screenContext = UtilGenerics.cast(serviceContext.remove("screenContext"));
         String contentType = (String) serviceContext.remove("contentType");
         String filePath = (String) serviceContext.remove("filePath");
-        String fileName = (String) serviceContext.remove("fileName");
+        String fileName = new File((String) serviceContext.remove("fileName")).getName();
 
         if (UtilValidate.isEmpty(screenContext)) {
             screenContext = new HashMap<>();
@@ -265,7 +265,12 @@ public static Map<String, Object> createFileFromScreen(DispatchContext dctx, Map
             if (UtilValidate.isEmpty(filePath)) {
                 filePath = EntityUtilProperties.getPropertyValue("content", "content.output.path", "/output", delegator);
             }
-            File file = new File(filePath, fileName);
+            File baseDir = new File(filePath).getCanonicalFile();
+            File file = new File(baseDir, fileName).getCanonicalFile();
+            if (!file.toPath().startsWith(baseDir.toPath())) {
+                return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "ContentRenderingPathTraversalError",
+                        UtilMisc.toMap("fileName", fileName, "filePath", filePath), locale));
+            }
 
             FileOutputStream fos = new FileOutputStream(file);
             fos.write(baos.toByteArray());