security: NativeProcessLauncher path traversal check is incomplete - does not handle symlinks or encoded paths

[sfloess]

Description

In NativeProcessLauncher.java, the path traversal check uses path.contains("../") to detect directory traversal attempts. This check is insufficient because:

1. It does not handle URL-encoded sequences (e.g., %2e%2e%2f)
2. It does not resolve symlinks (a symlink could point outside the allowed directory)
3. It does not handle Windows-style separators (..\\) if the platform runs on Windows
4. It does not canonicalize the path before checking

Location

platform-core/src/main/java/org/flossware/platform/core/NativeProcessLauncher.java

• Path validation uses simple string contains("../") check

Impact

• An attacker could potentially escape the allowed directory by using symlinks or encoded paths
• Could execute arbitrary native binaries outside the designated directory

Suggested Fix

1. Canonicalize the path using Path.toRealPath() (which resolves symlinks)
2. Verify the canonical path starts with the canonical allowed base directory
3. Reject paths containing null bytes or other special characters
4. Example: Paths.get(inputPath).toRealPath().startsWith(allowedDir.toRealPath())

Labels

bug, security