fix: add path traversal validation for loadRecords taskId and add corresponding tests

Author: hengyuss

shenyu-admin/src/main/java/org/apache/shenyu/admin/record/LocalJsonFileHttpRecordRepository.java

@@ -108,7 +108,15 @@ public List<RecordTaskInfo> listRecordTasks() {
 
     @Override
     public List<ShenyuHttpRequestRecordDTO.Record> loadRecords(final String taskId) {
-        Path filePath = Paths.get(properties.getStoragePath(), taskId + ".jsonl");
+        if (StringUtils.isBlank(taskId) || !taskId.matches("^[a-zA-Z0-9_-]+$")) {
+            LOG.warn("Invalid taskId: {}", taskId);
+            return new ArrayList<>();
+        }
+        Path filePath = Paths.get(properties.getStoragePath(), taskId + ".jsonl").normalize();
+        if (!filePath.startsWith(Paths.get(properties.getStoragePath()).normalize())) {
+            LOG.warn("Path traversal detected: {}", taskId);
+            return new ArrayList<>();
+        }
         List<ShenyuHttpRequestRecordDTO.Record> records = new ArrayList<>();
         if (!Files.exists(filePath)) {
             LOG.warn("Record file not found: {}", filePath);

shenyu-admin/src/test/java/org/apache/shenyu/admin/record/LocalJsonFileHttpRecordRepositoryTest.java

@@ -278,6 +278,45 @@ void testListRecordTasksWithMultipleFiles() throws IOException {
         assertEquals(2, taskMap.get("beta").getRecordCount());
     }
 
+    @Test
+    void testLoadRecordsWithInvalidTaskIdPathTraversal() {
+        List<ShenyuHttpRequestRecordDTO.Record> loaded = repository.loadRecords("../../etc/passwd");
+        assertTrue(loaded.isEmpty());
+    }
+
+    @Test
+    void testLoadRecordsWithInvalidTaskIdNull() {
+        List<ShenyuHttpRequestRecordDTO.Record> loaded = repository.loadRecords(null);
+        assertTrue(loaded.isEmpty());
+    }
+
+    @Test
+    void testLoadRecordsWithInvalidTaskIdBlank() {
+        List<ShenyuHttpRequestRecordDTO.Record> loaded = repository.loadRecords("");
+        assertTrue(loaded.isEmpty());
+        loaded = repository.loadRecords("   ");
+        assertTrue(loaded.isEmpty());
+    }
+
+    @Test
+    void testLoadRecordsWithInvalidTaskIdSpecialChars() {
+        assertTrue(repository.loadRecords("task/1").isEmpty());
+        assertTrue(repository.loadRecords("task\\1").isEmpty());
+        assertTrue(repository.loadRecords("task.1").isEmpty());
+        assertTrue(repository.loadRecords("task id").isEmpty());
+        assertTrue(repository.loadRecords("task!@#").isEmpty());
+    }
+
+    @Test
+    void testLoadRecordsWithValidTaskIdCharacters() throws IOException {
+        ShenyuHttpRequestRecordDTO.Record record = buildRecord("task-1_abc", "trace-1", "GET", "/a", null, null, null);
+        repository.save(buildDTO(Collections.singletonList(record)));
+
+        List<ShenyuHttpRequestRecordDTO.Record> loaded = repository.loadRecords("task-1_abc");
+        assertEquals(1, loaded.size());
+        assertEquals("task-1_abc", loaded.get(0).getTaskId());
+    }
+
     @Test
     void testLoadRecordsWithMultipleRecords() {
         ShenyuHttpRequestRecordDTO.Record r1 = buildRecord("task-1", "trace-1", "GET", "/a", null, null, null);