TEZ-4699:Add Validation/Canonical checks to avoid path exploitation in CSVResult.java

Author: ramitg254

tez-tools/analyzers/job-analyzer/src/main/java/org/apache/tez/analyzer/CSVResult.java

@@ -23,7 +23,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStreamWriter;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Comparator;
@@ -93,31 +93,53 @@ public void setComments(String comments) {
         '}';
   }
 
-  //For testing
+  private static File validateOutputFile(String fileName) throws IOException {
+    //null or empty string check
+    if (fileName == null || fileName.trim().isEmpty()) {
+      throw new IllegalArgumentException("fileName must not be null or empty");
+    }
+
+    // support use of relative path
+    File target = new File(fileName).getCanonicalFile();
+    File parent = target.getParentFile();
+
+
+    // check if the parent directory exists
+    if (parent == null || !parent.isDirectory()) {
+      throw new IOException("Parent directory does not exist: " + parent);
+    }
+    // check if the parent directory is writable
+    if (!parent.canWrite()) {
+      throw new IOException("No write permission on directory: " + parent);
+    }
+    // it should not write to any existing file to avoid file corruption
+    if (target.exists()) {
+      throw new IOException("Output file already exists, will not overwrite: " + target);
+    }
+    return target;
+  }
+
   public void dumpToFile(String fileName) throws IOException {
-    OutputStreamWriter writer = new OutputStreamWriter(
-        new FileOutputStream(new File(fileName)),
-        Charset.forName("UTF-8").newEncoder());
-    BufferedWriter bw = new BufferedWriter(writer);
-    bw.write(Joiner.on(",").join(headers));
-    bw.newLine();
-    for (String[] record : recordsList) {
-
-      if (record.length != headers.length) {
-        continue; //LOG error msg?
-      }
+    File target = validateOutputFile(fileName);
 
-      StringBuilder sb = new StringBuilder();
-      for(int i=0;i<record.length;i++) {
-        sb.append(!Strings.isNullOrEmpty(record[i]) ? record[i] : " ");
-        if (i < record.length - 1) {
-          sb.append(",");
+    try (BufferedWriter bw = new BufferedWriter(
+        new OutputStreamWriter(new FileOutputStream(target), StandardCharsets.UTF_8))) {
+      bw.write(Joiner.on(",").join(headers));
+      bw.newLine();
+      for (String[] record : recordsList) {
+        if (record.length != headers.length) {
+          continue;
+        }
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < record.length; i++) {
+          sb.append(!Strings.isNullOrEmpty(record[i]) ? record[i] : " ");
+          if (i < record.length - 1) {
+            sb.append(",");
+          }
         }
+        bw.write(sb.toString());
+        bw.newLine();
       }
-      bw.write(sb.toString());
-      bw.newLine();
     }
-    bw.flush();
-    bw.close();
   }
 }