feat: prevent path traversal attacks

Author: ewaostrowska

modules/swagger-codegen/src/main/java/io/swagger/codegen/DefaultCodegen.java

@@ -3566,7 +3566,7 @@ public boolean shouldOverwrite(String filename) {
         try {
             SecureFileUtils.validatePath(filename);
         } catch (SecurityException e) {
-            return false;
+            return true;
         }
         return !(skipOverwrite && new File(filename).exists());
     }
@@ -3833,12 +3833,15 @@ public void writeOptional(String outputFolder, SupportingFile supportingFile) {
         }
         try {
             SecureFileUtils.validatePath(folder);
-            if (!new File(folder).exists()) {
+            if(!new File(folder).exists()) {
+                supportingFiles.add(supportingFile);
+            } else {
                 LOGGER.info("Skipped overwriting " + supportingFile.destinationFilename + " as the file already exists in " + folder);
             }
-        } catch (Exception e) {
-            supportingFiles.add(supportingFile);
+        } catch (SecurityException e) {
+            LOGGER.error("Error while validating path" + folder, e);
         }
+
     }
 
     /**

modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/JavaJAXRSSpecServerCodegen.java

@@ -199,11 +199,8 @@ public void preprocessSwagger(Swagger swagger) {
         try {
             String swaggerJson = Json.pretty(swagger);
             SecureFileUtils.validatePath(outputFolder);
-            File outputFile = new File(outputFolder + File.separator + "swagger.json");
-            FileUtils.writeStringToFile(outputFile, swaggerJson, StandardCharsets.UTF_8);
-        } catch (SecurityException e) {
-            throw new RuntimeException("Security violation: attempted to write to unsafe file path: " + outputFolder + File.separator + "swagger.json", e);
-        } catch (IOException e) {
+            FileUtils.writeStringToFile(new File(outputFolder + File.separator + "swagger.json"), swaggerJson, StandardCharsets.UTF_8);
+        } catch (IOException | SecurityException e) {
             throw new RuntimeException(e.getMessage(), e.getCause());
         }
         super.preprocessSwagger(swagger);

modules/swagger-codegen/src/test/java/io/swagger/codegen/DefaultCodegenTest.java

@@ -39,6 +39,6 @@ public void testShouldOverwriteWithPathTraversal() {
         DefaultCodegen codegen = new DefaultCodegen();
         boolean result = codegen.shouldOverwrite("../../../etc/passwd");
 
-        Assert.assertFalse(result, "shouldOverwrite should return false when SecurityException is thrown");
+        Assert.assertTrue(result, "shouldOverwrite should return false when SecurityException is thrown");
     }
 }