Check for root directory exposure also for folder retention.

Author: raphw

byte-buddy-dep/src/main/java/net/bytebuddy/build/Plugin.java

@@ -3860,11 +3860,15 @@ public void store(ClassFileVersion classFileVersion, Map<TypeDescription, byte[]
                 public void retain(Source.Element element) throws IOException {
                     String name = element.getName();
                     File target = new File(folder, name);
-                    if (!name.endsWith("/")) {
+                    String basePath = folder.getCanonicalPath(), targetPath = target.getCanonicalPath(), prefix = basePath;
+                    if (!prefix.endsWith(File.separator)) {
+                        prefix += File.separatorChar;
+                    }
+                    if (!targetPath.equals(basePath) && !targetPath.startsWith(prefix)) {
+                        throw new IllegalArgumentException(target + " is not a subdirectory of " + folder);
+                    } else if (!name.endsWith("/")) {
                         File resolved = element.resolveAs(File.class);
-                        if (!target.getCanonicalPath().startsWith(folder.getCanonicalPath() + File.separatorChar)) {
-                            throw new IllegalArgumentException(target + " is not a subdirectory of " + folder);
-                        } else if (!target.getParentFile().isDirectory() && !target.getParentFile().mkdirs()) {
+                        if (!target.getParentFile().isDirectory() && !target.getParentFile().mkdirs()) {
                             throw new IOException("Could not create directory: " + target.getParent());
                         } else if (resolved != null && !resolved.equals(target)) {
                             if (link) {

byte-buddy-dep/src/test/java/net/bytebuddy/build/PluginEngineTargetForFolderTest.java

@@ -209,4 +209,12 @@ public void testCannotWriteRelativeLocation() throws Exception {
         when(element.getName()).thenReturn("../illegal");
         target.write(Plugin.Engine.Source.Origin.NO_MANIFEST).retain(element);
     }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void testCannotWriteRelativeDirectory() throws Exception {
+        Plugin.Engine.Target target = new Plugin.Engine.Target.ForFolder(folder);
+        Plugin.Engine.Source.Element element = mock(Plugin.Engine.Source.Element.class);
+        when(element.getName()).thenReturn("../illegal/");
+        target.write(Plugin.Engine.Source.Origin.NO_MANIFEST).retain(element);
+    }
 }