GRAD2-1806

New Report for SSW: Projected Grad
bcgov · Oct 3, 2024 · 07d2834 · 07d2834
1 parent 6627155
commit 07d2834
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/api/src/main/java/ca/bc/gov/educ/grad/report/service/impl/GradReportServiceImpl.java b/api/src/main/java/ca/bc/gov/educ/grad/report/service/impl/GradReportServiceImpl.java
@@ -143,11 +143,18 @@ Certificate getCertificate(ReportData reportData) {
 
     InputStream openImageResource(final String resource) throws IOException {
         /** final URL url = getReportResource(resource); **/
+        validateResourcePath(resource);
         URL url = this.getClass().getResource(String.format(DIR_IMAGE_BASE, resource));
         assert url != null;
         return url.openStream();
     }
 
+    void validateResourcePath(String resource) {
+        if(StringUtils.isBlank(resource) || resource.contains("..") || resource.contains("/") || resource.contains("\\")) {
+            throw new IllegalArgumentException("Invalid resource path");
+        }
+    }
+
     GraduationReport getGraduationReport(String methodName, List<String> excludePrograms) throws IOException {
         Parameters<String, Object> parameters = createParameters();