[ZEPPELIN-6692] Extract shared path normalization for note and folder paths

Author: gyowoo1113

zeppelin-server/src/main/java/org/apache/zeppelin/notebook/repo/NotebookPathValidator.java

@@ -85,6 +85,31 @@ public static String decodeRepeatedly(String encoded) throws IOException {
     throw new IOException("Exceeded maximum decode attempts. Possible malicious input.");
   }
 
+  /**
+   * Normalizes a path using the rules shared by note and folder paths.
+   *
+   * @param path the path to normalize
+   * @return the normalized path
+   * @throws IOException if the path cannot be normalized
+   */
+  public static String normalizePath(String path) throws IOException {
+    if (path == null) {
+      throw new IOException("Path must not be null");
+    }
+
+    if (!path.startsWith("/")) {
+      path = "/" + path;
+    }
+
+    path = decodeRepeatedly(path);
+
+    if (path.contains("..")) {
+      throw new IOException("Path can not contain '..'");
+    }
+
+    return path;
+  }
+
   /**
    * Requires {@code folderPath} to use the canonical absolute folder-path form.
    *

zeppelin-server/src/main/java/org/apache/zeppelin/service/NotebookService.java

@@ -234,13 +234,11 @@ String normalizeNotePath(String notePath) throws IOException {
     if (StringUtils.isBlank(notePath)) {
       notePath = "/Untitled Note";
     }
-    if (!notePath.startsWith("/")) {
-      notePath = "/" + notePath;
-    }
 
     notePath = notePath.replace("\r", " ").replace("\n", " ");
 
-    notePath = NotebookPathValidator.decodeRepeatedly(notePath);
+    notePath = NotebookPathValidator.normalizePath(notePath);
+
     if (notePath.endsWith("/")) {
       throw new IOException("Note name shouldn't end with '/'");
     }
@@ -250,9 +248,6 @@ String normalizeNotePath(String notePath) throws IOException {
       throw new IOException("Note name must be less than 255");
     }
 
-    if (notePath.contains("..")) {
-      throw new IOException("Note name can not contain '..'");
-    }
     return notePath;
   }
 
@@ -265,15 +260,7 @@ String normalizeNotePath(String notePath) throws IOException {
    * @throws IOException
    */
   String normalizeFolderPath(String folderPath) throws IOException {
-    if (folderPath == null) {
-      throw new IOException("Folder path must not be null");
-    }
-
-    if (!folderPath.startsWith("/")) {
-      folderPath = "/" + folderPath;
-    }
-
-    return folderPath;
+    return NotebookPathValidator.normalizePath(folderPath);
   }
 
   public void removeNote(String noteId,

zeppelin-server/src/test/java/org/apache/zeppelin/notebook/repo/NotebookRepoPathValidationTest.java

@@ -110,4 +110,41 @@ void decodeRepeatedly_accepts_max_decode_layers() throws IOException {
     // cleanly; the constant means *layers*, not raw loop iterations.
     assertEquals("/..", NotebookPathValidator.decodeRepeatedly("/%252525252e%252525252e"));
   }
+
+  @Test
+  void normalizePath_adds_leading_slash() throws IOException {
+    assertEquals("/folder/note", NotebookPathValidator.normalizePath("folder/note"));
+  }
+
+  @Test
+  void normalizePath_keeps_existing_leading_slash() throws IOException {
+    assertEquals("/folder/note", NotebookPathValidator.normalizePath("/folder/note"));
+  }
+
+  @Test
+  void normalizePath_decodes_url_encoding() throws IOException {
+    assertEquals("/folder/My Note", NotebookPathValidator.normalizePath("/folder/My%20Note"));
+  }
+
+  @Test
+  void normalizePath_decodes_repeated_url_encoding() throws IOException {
+    assertEquals("/folder/My Note", NotebookPathValidator.normalizePath("/folder/My%2520Note"));
+  }
+
+  @ParameterizedTest
+  @ValueSource(strings = {
+      "/foo/../bar",
+      "/foo..bar",
+      "/...",
+      "/%2e%2e/bar",
+      "/%252e%252e/bar"
+  })
+  void normalizePath_rejects_double_dot(String path) {
+    assertThrows(IOException.class, () -> NotebookPathValidator.normalizePath(path));
+  }
+
+  @Test
+  void normalizePath_rejects_null() {
+    assertThrows(IOException.class, () -> NotebookPathValidator.normalizePath(null));
+  }
 }

zeppelin-server/src/test/java/org/apache/zeppelin/service/NotebookServiceTest.java

@@ -796,20 +796,20 @@ void testNormalizeNotePath() throws IOException {
       notebookService.normalizeNotePath("my..note");
       fail("Should fail");
     } catch (IOException e) {
-      assertEquals("Note name can not contain '..'", e.getMessage());
+      assertEquals("Path can not contain '..'", e.getMessage());
     }
     try {
       notebookService.normalizeNotePath("%2e%2e/%2e%2e/tmp/test222");
       fail("Should fail");
     } catch (IOException e) {
-      assertEquals("Note name can not contain '..'", e.getMessage());
+      assertEquals("Path can not contain '..'", e.getMessage());
     }
     try {
       // Double URL encoding of ".."
       notebookService.normalizeNotePath("%252e%252e/%252e%252e/tmp/test333");
       fail("Should fail");
     } catch (IOException e) {
-      assertEquals("Note name can not contain '..'", e.getMessage());
+      assertEquals("Path can not contain '..'", e.getMessage());
     }
     try {
       notebookService.normalizeNotePath("%25252525252e%25252525252e/tmp/test444");