Fixed: Update checkContextFileBoundary method visibility and ensure it is called in DataServices to validate file paths

(cherry picked from commit 44c9055)

Author: jacopoc

applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java

@@ -541,7 +541,7 @@ private static void checkOfbizFileAllowList(File file) throws GeneralException {
     /**
      * Checks that the given file is within the provided context root directory.
      */
-    private static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
+    static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
         try {
             String canonicalAllowed = new File(contextRoot).getCanonicalPath();
             String canonicalFilePath = file.getCanonicalPath();
@@ -1282,10 +1282,10 @@ public static void renderFile(String dataResourceTypeId, String objectInfo, Stri
                 sep = "/";
             }
             File file = FileUtil.getFile(prefix + sep + objectInfo);
+            checkContextFileBoundary(file, rootDir);
             if (!file.exists()) {
                 throw new FileNotFoundException("No file found: " + file.getAbsolutePath());
             }
-            checkContextFileBoundary(file, rootDir);
             try (InputStreamReader in = new InputStreamReader(new FileInputStream(file), StandardCharsets.UTF_8)) {
                 if (Debug.infoOn()) {
                     String enc = in.getEncoding();

applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java

@@ -268,6 +268,11 @@ public static Map<String, Object> createFileMethod(DispatchContext dctx, Map<Str
                 sep = "/";
             }
             file = new File(prefix + sep + objectInfo);
+            try {
+                DataResourceWorker.checkContextFileBoundary(file, prefix);
+            } catch (GeneralException e) {
+                return ServiceUtil.returnError(e.getMessage());
+            }
         }
         if (file == null) {
             return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "ContentUnableObtainReferenceToFile",
@@ -478,6 +483,11 @@ public static Map<String, Object> updateFileMethod(DispatchContext dctx, Map<Str
                     sep = "/";
                 }
                 file = new File(prefix + sep + objectInfo);
+                try {
+                    DataResourceWorker.checkContextFileBoundary(file, prefix);
+                } catch (GeneralException e) {
+                    return ServiceUtil.returnError(e.getMessage());
+                }
             }
             if (file == null) {
                 throw new IOException("File is null");