Validate base directory

Closes gh-1811

Author: mhalbritter

initializr-web/src/main/java/io/spring/initializr/web/project/DefaultProjectRequestToDescriptionConverter.java

@@ -119,6 +119,7 @@ public void convert(ProjectRequest request, MutableProjectDescription descriptio
 	}
 
 	private void validate(ProjectRequest request, InitializrMetadata metadata) {
+		validateBaseDir(request);
 		validatePlatformVersion(request, metadata);
 		validateType(request.getType(), metadata);
 		validateLanguage(request.getLanguage(), metadata);
@@ -127,6 +128,17 @@ private void validate(ProjectRequest request, InitializrMetadata metadata) {
 		validateDependencies(request, metadata);
 	}
 
+	private void validateBaseDir(ProjectRequest request) {
+		String baseDir = request.getBaseDir();
+		if (baseDir == null) {
+			return;
+		}
+		if (baseDir.contains("/") || baseDir.contains("\\") || baseDir.contains("..")) {
+			throw new InvalidProjectRequestException(
+					"Invalid baseDir '%s': must not contain path separators or '..'".formatted(baseDir));
+		}
+	}
+
 	private void validatePlatformVersion(ProjectRequest request, InitializrMetadata metadata) {
 		Version platformVersion = Version.safeParse(request.getBootVersion());
 		Platform platform = metadata.getConfiguration().getEnv().getPlatform();

initializr-web/src/test/java/io/spring/initializr/web/project/DefaultProjectRequestToDescriptionConverterTests.java

@@ -79,6 +79,50 @@ void convertWhenPackageNameHasAccentCleanValue() {
 		assertThat(description.getPackageName()).isEqualTo("com.example.app");
 	}
 
+	@Test
+	void convertWhenBaseDirContainsPathSeparatorShouldThrowException() {
+		ProjectRequest request = createProjectRequest();
+		request.setBaseDir("my/project");
+		assertThatExceptionOfType(InvalidProjectRequestException.class)
+			.isThrownBy(() -> this.converter.convert(request, this.metadata))
+			.withMessageContaining("Invalid baseDir 'my/project'");
+	}
+
+	@Test
+	void convertWhenBaseDirContainsWindowsPathSeparatorShouldThrowException() {
+		ProjectRequest request = createProjectRequest();
+		request.setBaseDir("my\\project");
+		assertThatExceptionOfType(InvalidProjectRequestException.class)
+			.isThrownBy(() -> this.converter.convert(request, this.metadata))
+			.withMessageContaining("Invalid baseDir 'my\\project'");
+	}
+
+	@Test
+	void convertWhenBaseDirContainsDotDotShouldThrowException() {
+		ProjectRequest request = createProjectRequest();
+		request.setBaseDir("../dirup");
+		assertThatExceptionOfType(InvalidProjectRequestException.class)
+			.isThrownBy(() -> this.converter.convert(request, this.metadata))
+			.withMessageContaining("Invalid baseDir '../dirup'");
+	}
+
+	@Test
+	void convertWhenBaseDirIsExactlyDotDotShouldThrowException() {
+		ProjectRequest request = createProjectRequest();
+		request.setBaseDir("..");
+		assertThatExceptionOfType(InvalidProjectRequestException.class)
+			.isThrownBy(() -> this.converter.convert(request, this.metadata))
+			.withMessageContaining("Invalid baseDir '..'");
+	}
+
+	@Test
+	void convertWhenBaseDirIsValidShouldSetBaseDirectory() {
+		ProjectRequest request = createProjectRequest();
+		request.setBaseDir("my-project");
+		ProjectDescription description = this.converter.convert(request, this.metadata);
+		assertThat(description.getBaseDirectory()).isEqualTo("my-project");
+	}
+
 	@Test
 	void convertWhenTypeIsInvalidShouldThrowException() {
 		ProjectRequest request = createProjectRequest();