public static boolean isPathContained ( List < String > allowedPaths , String targetPath ) { if ( allowedPaths == null || allowedPaths . isEmpty ( ) || targetPath == null ) { return false ; } //Remove trailing slashes, if applicable if ( ! targetPath . isEmpty ( ) && targetPath . charAt ( targetPath . length ( ) - 1 ) == ' ' && targetPath . length ( ) > 1 && ! isWindowsRootDirectory ( targetPath ) ) { targetPath = targetPath . substring ( 0 , targetPath . length ( ) - 1 ) ; } while ( targetPath != null ) { if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Target path: " + targetPath ) ; } for ( int i = 0 ; i < allowedPaths . size ( ) ; i ++ ) { //String allowedPath = it.next(); String allowedPath = allowedPaths . get ( i ) ; if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Checking path: " + allowedPath ) ; } //When we have a configuration that explicitly sets an empty read or write list, then we get a non-empty set //with a single empty string. So we must catch empty cases here, otherwise the comparisons below might be incorrect. if ( "" . equals ( allowedPath ) ) { if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Skipping an empty path" ) ; } continue ; } //We are always doing case-insensitive comparisons because we can't reliably find out //if the windows machine has changed its registry key to allow sensitivity, nor do we //know if the remote host is a certain OS. For the purposes of this method (checking for access //to a directory) it is safe to assume case insensitivity. if ( allowedPath . equalsIgnoreCase ( targetPath ) ) { return true ; } } // We'll check 'up' the target path's parent chain to see if that's // covered by the allowed paths. targetPath = getNormalizedParent ( targetPath ) ; } return false ; }
Returns true if the targetPath is contained within one of the allowedPaths .