Path traversal vulnerability, when using Directory on Windows

[idringvard]

Affected OS: Windows
Restlet version: 2.3.10

When use static files serving, it is possible to bypass upper directory check and download files, that are outside configured directory.

Considering following directory structure

 C:\
  | - static
  | - | - resources
  | - | - | - html
  | - Windows
  | - | - .......

and following code:

public class PathTraversalServer {

    public static void main(String[] args) {
        Component component = new Component();
        component.getServers().add(Protocol.HTTP, 8080);
        component.getClients().add(Protocol.FILE);
        component.getDefaultHost().attach("", new FileDownloadApplication());
        try {
            component.start();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    static class FileDownloadApplication extends Application {

        @Override
        public Restlet createInboundRoot() {
            Router router = new Router(getContext());
            router.setDefaultMatchingMode(Template.MODE_EQUALS);
            Directory dir = new Directory(getContext(), "file:///C:/static/resources/html");
            router.attach("/static", dir);
            return router;
        }
    }
}

then when navigate in browser using following URL:
http://localhost:8080/static/..%5c..%5c..%5cWindows%5cnotepad.exe, it is possible to download notepad.exe file.

When debugging, fond that above URL transates into following local resource URI:
file:///C:/static/resource/html/..\\..\\..\\Windows\\notepad.exe, which is valid Windows URI and, which able to bypass DirectoryServerResource.preventUpperDirectoryAccess() check.

To workaround problem I use followng code:

public class PathTraversalServer {

    public static void main(String[] args) {
        Component component = new Component();
        component.getServers().add(Protocol.HTTP, 8080);
        component.getClients().add(Protocol.FILE);
        component.getDefaultHost().attach("", new FileDownloadApplication());
        try {
            component.start();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    static class FileDownloadApplication extends Application {

        @Override
        public Restlet createInboundRoot() {
            Router router = new Router(getContext());
            router.setDefaultMatchingMode(Template.MODE_EQUALS);
            Directory dir = new Directory(getContext(), "file:///C:/static/resources/html");
            dir.setTargetClass(StopPathTraversalResource.class);
            router.attach("/static", dir);
            return router;
        }
    }
    
    static class StopPathTraversalResource extends DirectoryServerResource {

        @Override
        public void preventUpperDirectoryAccess() {
            try {
                URI targetUri = new URI(getTargetUri());
                Path targetPath = Paths.get(targetUri).normalize();
                URI baseUri = new URI(getDirectory().getRootRef().toString());
                Path basePath = Paths.get(baseUri).normalize();
                if (!targetPath.startsWith(basePath)) {
                    throw new ResourceException(Status.CLIENT_ERROR_FORBIDDEN);
                }
            } catch (URISyntaxException e) {
                throw new ResourceException(e);
            }
        }
    }
}

[jlouvel]

@thboileau Let's work to get this fixed in 2.4.4 and 2,5 branch.