Fix(Webserver) #6225 Added check in file creation path for _flows*

webserver/src/main/java/io/kestra/webserver/controllers/api/NamespaceFileController.java

@@ -48,9 +48,7 @@ public class NamespaceFileController {
     @Inject
     private FlowService flowService;
 
-    private final List<Pattern> forbiddenPathPatterns = List.of(
-        Pattern.compile("/" + FLOWS_FOLDER + ".*")
-    );
+    private static final String DELIMITER_SLASH = "/";
 
 
     @ExecuteOn(TaskExecutors.IO)
@@ -183,8 +181,12 @@ public synchronized int available() {
 
     private void putNamespaceFile(String tenantId, String namespace, URI path, BufferedInputStream inputStream) throws IOException {
         String filePath = path.getPath();
-        if(filePath.matches("/" + FLOWS_FOLDER + "/.*")) {
-            if(filePath.split("/").length != 3) {
+        if (filePath.startsWith(DELIMITER_SLASH)) {
+            filePath = filePath.substring(1);
+        }
+        String[] filePaths = filePath.split(DELIMITER_SLASH);
+        if (filePaths.length != 0 && filePaths[0].startsWith(FLOWS_FOLDER)) {
+            if(filePaths.length != 2) {
                 throw new IllegalArgumentException("Invalid flow file path: " + filePath);
             }
 
@@ -193,7 +195,6 @@ private void putNamespaceFile(String tenantId, String namespace, URI path, Buffe
             this.importFlow(tenantId, flowSource);
             return;
         }
-
         storageInterface.put(tenantId, namespace, NamespaceFile.of(namespace, path).uri(), inputStream);
     }
 
@@ -297,8 +298,15 @@ private void forbiddenPathsGuard(URI path) {
         if (path == null) {
             return;
         }
-
-        if (forbiddenPathPatterns.stream().anyMatch(pattern -> pattern.matcher(path.getPath()).matches())) {
+        String filePath = path.getPath();
+        if (filePath.startsWith(DELIMITER_SLASH)) {
+            filePath = filePath.substring(1);
+        }
+        String[] splitPath = filePath.split(DELIMITER_SLASH);
+        if(splitPath.length == 0) {
+            return;
+        }
+        if (splitPath[0].startsWith(FLOWS_FOLDER)) {
             throw new IllegalArgumentException("Forbidden path: " + path.getPath());
         }
     }

webserver/src/test/java/io/kestra/webserver/controllers/api/NamespaceFileControllerTest.java

@@ -41,6 +41,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.*;
 import static org.hamcrest.core.Is.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 @KestraTest
 class NamespaceFileControllerTest extends JdbcH2ControllerTest {
@@ -141,6 +142,28 @@ void createDirectory() throws IOException {
         assertThat(res.getType(), is(FileAttributes.FileType.Directory));
     }
 
+    @Test
+    void createDirectoryException() {
+    assertThrows(
+        HttpClientResponseException.class,
+        () ->
+            client
+                .toBlocking()
+                .exchange(
+                    HttpRequest.POST(
+                        "/api/v1/namespaces/" + NAMESPACE + "/files/directory?path=/_flows",
+                        null)));
+    assertThrows(
+        HttpClientResponseException.class,
+        () ->
+            client
+                .toBlocking()
+                .exchange(
+                    HttpRequest.POST(
+                        "/api/v1/namespaces/" + NAMESPACE + "/files/directory?path=/_flows2",
+                        null)));
+    }
+
     @Test
     void createFile() throws IOException {
         MultipartBody body = MultipartBody.builder()
@@ -153,6 +176,24 @@ void createFile() throws IOException {
         assertNamespaceFileContent(URI.create("/test.txt"), "Hello");
     }
 
+    @Test
+    void createFileFlowException() {
+        MultipartBody body = MultipartBody.builder()
+            .addPart("fileContent", "_flows", "Hello".getBytes())
+            .build();
+        assertThrows(HttpClientResponseException.class, () -> client.toBlocking().exchange(
+            HttpRequest.POST("/api/v1/namespaces/" + NAMESPACE + "/files?path=/_flows", body)
+                .contentType(MediaType.MULTIPART_FORM_DATA_TYPE)
+        ));
+        MultipartBody body2 = MultipartBody.builder()
+            .addPart("fileContent", "_flows2", "Hello".getBytes())
+            .build();
+        assertThrows(HttpClientResponseException.class, () -> client.toBlocking().exchange(
+            HttpRequest.POST("/api/v1/namespaces/" + NAMESPACE + "/files?path=/_flows2", body2)
+                .contentType(MediaType.MULTIPART_FORM_DATA_TYPE)
+        ));
+    }
+
     @Test
     void createFile_AddFlow() throws IOException {
         String flowSource = flowRepository.findByIdWithSource(null, "io.kestra.tests", "task-flow").get().getSource();