Next patch release (v2.1.2)

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
     # Command-line programs to run using the OS shell.
     # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/gradle.yml

@@ -22,16 +22,16 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up openJDK version
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: ${{ matrix.jdk }}
           distribution: "zulu"
       - name: Install Dependencies
         run: npm install -g ro-crate-html-js
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       - name: Build and Test with Gradle
         run: ./gradlew -Dprofile=release build
       - name: Upload (test) reports as artifact on GitHub on manual runs
@@ -47,9 +47,9 @@ jobs:
       jdkversion: 25
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up OpenJDK version ...
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: "zulu"
           java-version: ${{ env.jdkversion }}

.github/workflows/publishRelease.yml

@@ -8,9 +8,9 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Java
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 21
           distribution: 'zulu' # openjdk

build.gradle

@@ -38,12 +38,12 @@ repositories {
 }
 
 ext {
-    jacksonVersion  = '2.22.0'
+    jacksonVersion  = '2.22.1'
 }
 
 dependencies {
     // JUnit setup for testing
-    testImplementation(platform("org.junit:junit-bom:6.1.0"))
+    testImplementation(platform("org.junit:junit-bom:6.1.3"))
     testImplementation('org.junit.jupiter:junit-jupiter')
     testRuntimeOnly('org.junit.platform:junit-platform-launcher')
     // JSON object mapping / (de-)serialization
@@ -58,7 +58,7 @@ dependencies {
     // compare json documents in tests
     implementation 'com.github.fslev:json-compare:8.1'
     // url validator
-    implementation group: 'commons-validator', name: 'commons-validator', version: '1.10.1'
+    implementation group: 'commons-validator', name: 'commons-validator', version: '1.11.0'
     // logging
     implementation group: 'org.slf4j', name: 'slf4j-jdk14', version: '2.0.18'
     // JSON-LD, Zenodo mapping

src/main/java/edu/kit/datamanager/ro_crate/entities/data/DataEntity.java

@@ -48,6 +48,16 @@ public void addAuthorId(String id) {
         this.addIdProperty("author", id);
     }
 
+    /**
+     * Gets the path of this entity.
+     * <p>
+     * When reading a crate, this will point to the entity's file within the crate.
+     * When creating a new entity or crate, it might point to a file outside the crate,
+     * as set by {@link DataEntityBuilder#setLocation(Path)}.
+     * Such a file will be copied into the crate when writing.
+     *
+     * @return the path to the file this entity represents.
+     */
     @JsonIgnore
     public Path getPath() {
         return path;

src/main/java/edu/kit/datamanager/ro_crate/reader/CrateReader.java

@@ -22,6 +22,7 @@
 import java.nio.file.Path;
 import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import java.util.stream.StreamSupport;
 
 /**
@@ -240,12 +241,13 @@ protected Optional<File> checkFolderHasFile(String filepathOrId, File folder) {
         if (IdentifierUtils.isUrl(filepathOrId)) {
             return Optional.empty();
         }
-        return IdentifierUtils.decode(filepathOrId)
-                .map(decoded -> folder.toPath().resolve(decoded).normalize())
+        return Stream.of(IdentifierUtils.decode(filepathOrId).orElse(filepathOrId), filepathOrId)
+                .map(filename -> folder.toPath().resolve(filename).normalize().toAbsolutePath())
                 // defence-in-depth: ensure we are still inside the crate folder
                 .filter(resolved -> resolved.startsWith(folder.toPath()))
                 .map(Path::toFile)
-                .filter(File::exists);
+                .filter(File::exists)
+                .findFirst();
     }
 
     /**

src/main/java/edu/kit/datamanager/ro_crate/writer/WriteFolderStrategy.java

@@ -5,6 +5,7 @@
 import edu.kit.datamanager.ro_crate.Crate;
 import edu.kit.datamanager.ro_crate.entities.data.DataEntity;
 import edu.kit.datamanager.ro_crate.objectmapper.MyObjectMapper;
+import edu.kit.datamanager.ro_crate.special.IdentifierUtils;
 import org.apache.commons.io.FileUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -14,6 +15,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
 
 /**
  * A class for writing a crate to a folder.
@@ -64,16 +66,25 @@ public void save(Crate crate, String destination) throws IOException {
             }
         }
         for (DataEntity dataEntity : crate.getAllDataEntities()) {
-            savetoFile(dataEntity, file);
+            saveToFile(dataEntity, file);
         }
     }
 
-    private void savetoFile(DataEntity entity, File file) throws IOException {
+    private void saveToFile(DataEntity entity, File file) throws IOException {
         if (entity.getPath() != null) {
+            String id = entity.getId();
+            String filename = IdentifierUtils.decode(id).orElse(id);
+            Path baseFolder = file.toPath().toAbsolutePath().normalize();
+            Path destination = baseFolder.resolve(filename).normalize();
+            // defence-in-depth: ensure the resolved path remains inside the crate folder
+            if (!destination.startsWith(baseFolder)) {
+                logger.warn("Skipping entity '{}': resolved path '{}' escapes destination folder '{}'", id, destination, file);
+                return;
+            }
             if (entity.getPath().toFile().isDirectory()) {
-                FileUtils.copyDirectory(entity.getPath().toFile(), file.toPath().resolve(entity.getId()).toFile());
+                FileUtils.copyDirectory(entity.getPath().toFile(), destination.toFile());
             } else {
-                FileUtils.copyFile(entity.getPath().toFile(), file.toPath().resolve(entity.getId()).toFile());
+                FileUtils.copyFile(entity.getPath().toFile(), destination.toFile());
             }
         }
     }

src/main/java/edu/kit/datamanager/ro_crate/writer/WriteZipStreamStrategy.java

@@ -10,11 +10,14 @@
 import java.io.*;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
 
 import edu.kit.datamanager.ro_crate.preview.CratePreview;
+import edu.kit.datamanager.ro_crate.special.IdentifierUtils;
 import edu.kit.datamanager.ro_crate.util.FileSystemUtil;
 import edu.kit.datamanager.ro_crate.util.ZipStreamUtil;
 import net.lingala.zip4j.io.outputstream.ZipOutputStream;
@@ -154,16 +157,67 @@ private void saveToStream(DataEntity entity, ZipOutputStream zipStream, String p
         }
 
         boolean isDirectory = entity.getPath().toFile().isDirectory();
+        String id = entity.getId();
+        String filename = IdentifierUtils.decode(id).orElse(id);
+        String safeName = sanitizeZipEntryName(filename);
+        if (safeName.isEmpty()) {
+            logger.warn("Skipping entity '{}': decoded name resolves outside the crate root", id);
+            return;
+        }
+        String entryName = prefix + safeName;
         if (isDirectory) {
             ZipStreamUtil.addFolderToZipStream(
                     zipStream,
                     entity.getPath().toFile(),
-                    prefix + entity.getId());
+                    entryName);
         } else {
             ZipStreamUtil.addFileToZipStream(
                     zipStream,
                     entity.getPath().toFile(),
-                    prefix + entity.getId());
+                    entryName);
+        }
+    }
+
+    /**
+     * Normalizes a decoded entry name into a safe relative path, consistent
+     * with the containment check in {@link WriteFolderStrategy#saveToFile}.
+     * <p>
+     * Absolute paths (leading {@code /}) and Windows drive-qualified paths
+     * (e.g. {@code C:/}) are rejected. Internal {@code .} and {@code ..}
+     * segments are resolved; if the result escapes the virtual crate root
+     * the name is rejected.
+     *
+     * @param name the raw decoded entry name
+     * @return a canonical relative entry name, or an empty string if the name
+     *         is absolute, drive-qualified, or escapes the crate root
+     */
+    private static String sanitizeZipEntryName(String name) {
+        // zip entries always use forward slashes as separators
+        String normalized = name.replace('\\', '/');
+
+        // Reject absolute paths and Windows drive-qualified paths (e.g. C:/)
+        if (normalized.startsWith("/")
+                || (normalized.length() >= 2 && normalized.charAt(1) == ':'
+                        && Character.isLetter(normalized.charAt(0)))) {
+            return "";
+        }
+
+        // Normalize "." and ".." segments, rejecting paths that escape the root
+        String[] segments = normalized.split("/");
+        List<String> stack = new ArrayList<>();
+        for (String segment : segments) {
+            if (segment.isEmpty() || segment.equals(".")) {
+                continue;
+            }
+            if (segment.equals("..")) {
+                if (stack.isEmpty()) {
+                    return "";
+                }
+                stack.remove(stack.size() - 1);
+            } else {
+                stack.add(segment);
+            }
         }
+        return String.join("/", stack);
     }
 }