[ZEPPELIN-6190] Prevent directory escape bypass through repeated URL decoding

[tbonelee]

What is this PR for?

This PR addresses an issue in NotebookService where the notebook path validation only performs a single decoding pass.
This allowed a malicious user to bypass validation by double-encoding the ".." token.
By implementing the repeated decoding, we can prevent this bypass.
Additionally, to prevent excessive decoding attempts, a maximum limit on the number of decoding attempts has been added.

What type of PR is it?

Hot Fix

What is the Jira issue?

https://issues.apache.org/jira/projects/ZEPPELIN/issues/ZEPPELIN-6190

How should this be tested?

• CI

Questions:

• Does the license files need to update? No
• Is there breaking changes for older versions?
  • There may be minor compatibility issues if a user relies on multiple encoded paths, but this is unlikely in realistic scenarios.
• Does this needs documentation? No

[tbonelee]

cc @jongyoul

[tbonelee]

@pan3793 @Reamer
When you have a moment, could you check this PR? Appreciate it!

[Reamer]

Just a few minor comments. The five attempts seem quite random. But I think it's good that an error message is thrown afterwards.

[tbonelee]

@Reamer Thank you for the feedback! I've added a commit based on your feedback.

I agree that using five attempts feels somewhat arbitrary. However I couldn't think of a better alternative, so I went with this value.
If you have any other suggestions, I'd love to hear them!

[Reamer]

LGTM, let's wait for CI

[pan3793]

I read the change and understand what it does, but I don't understand why should this change.
And please create a JIRA ticket for it, if you think this involves CVE which is not suitable to discuss publicly, you can write a detailed message to [email protected]

[Reamer]

I agree with @pan3793 . Please create a Jira ticket and adjust the pull request description accordingly.

[tbonelee]

For context: this PR was based on a security issue I received from @jongyoul, but I didn't have a Jira ticket at the time, which may have caused some confusion.

Apologies for the earlier lack of clarity - I've now created ZEPPELIN-6190 and linked this PR to it.

[jongyoul]

@tbonelee Thank you for sharing it.

@pan3793 @Reamer I missed sharing context with others as well. Sorry. This change relates to the security issue, so I thought it would be good to omit creating a ticket. Feel free to reach me if something is not clear. 🙏

[Reamer]

Merged into master and branch-0.12