private boolean isSymlinkSafe ( final Path file ) throws IOException { String canonicalPath = file . toRealPath ( ) . toString ( ) ; for ( String safePath : this . safePaths ) { if ( safePath . length ( ) > 0 ) { if ( safePath . startsWith ( fileSystem . getSeparator ( ) ) ) { /* * Absolute path */ if ( safePath . length ( ) > 0 && canonicalPath . length ( ) >= safePath . length ( ) && canonicalPath . startsWith ( safePath ) ) { return true ; } } else { /* * In relative path we build the path appending to base */ String absSafePath = base + fileSystem . getSeparator ( ) + safePath ; Path absSafePathFile = fileSystem . getPath ( absSafePath ) ; String canonicalSafePath = absSafePathFile . toRealPath ( ) . toString ( ) ; if ( canonicalSafePath . length ( ) > 0 && canonicalPath . length ( ) >= canonicalSafePath . length ( ) && canonicalPath . startsWith ( canonicalSafePath ) ) { return true ; } } } } return false ; }
Security check for followSymlinks feature . Only follows those symbolink links defined in safePaths .