Check directory path for security.

framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/ExceptionHandling/DefaultHttpExceptionStatusCodeFinder.cs

@@ -39,6 +39,8 @@ namespace Volo.Abp.AspNetCore.Mvc.ExceptionHandling
                     : HttpStatusCode.Unauthorized;
             }
 
+            //TODO: Handle SecurityException..?
+            
             if (exception is AbpValidationException)
             {
                 return HttpStatusCode.BadRequest;
@@ -58,7 +60,7 @@ namespace Volo.Abp.AspNetCore.Mvc.ExceptionHandling
             {
                 return HttpStatusCode.Forbidden;
             }
-
+            
             return HttpStatusCode.InternalServerError;
         }
     }

framework/src/Volo.Abp.Core/Volo/Abp/IO/DirectoryHelper.cs

@@ -1,4 +1,5 @@
 using System.IO;
+using JetBrains.Annotations;
 
 namespace Volo.Abp.IO
 {
@@ -7,10 +8,6 @@ namespace Volo.Abp.IO
     /// </summary>
     public static class DirectoryHelper
     {
-        /// <summary>
-        /// Creates a new directory if it does not exists.
-        /// </summary>
-        /// <param name="directory">Directory to create</param>
         public static void CreateIfNotExists(string directory)
         {
             if (!Directory.Exists(directory))
@@ -18,5 +15,35 @@ namespace Volo.Abp.IO
                 Directory.CreateDirectory(directory);
             }
         }
+
+        public static bool IsSubDirectoryOf([NotNull] string parentDirectoryPath, [NotNull] string childDirectoryPath)
+        {
+            Check.NotNull(parentDirectoryPath, nameof(parentDirectoryPath));
+            Check.NotNull(childDirectoryPath, nameof(childDirectoryPath));
+
+            return IsSubDirectoryOf(
+                new DirectoryInfo(parentDirectoryPath),
+                new DirectoryInfo(childDirectoryPath)
+            );
+        }
+
+        public static bool IsSubDirectoryOf([NotNull] DirectoryInfo parentDirectory, [NotNull]  DirectoryInfo childDirectory)
+        {
+            Check.NotNull(parentDirectory, nameof(parentDirectory));
+            Check.NotNull(childDirectory, nameof(childDirectory));
+
+            if (parentDirectory.FullName == childDirectory.FullName)
+            {
+                return true;
+            }
+
+            var parentOfChild = childDirectory.Parent;
+            if (parentOfChild == null)
+            {
+                return false;
+            }
+
+            return IsSubDirectoryOf(parentDirectory, parentOfChild);
+        }
     }
 }

modules/docs/src/Volo.Docs.Domain/Volo/Docs/FileSystem/Documents/FileSystemDocumentStore.cs

@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.IO;
+using System.Security;
 using System.Threading.Tasks;
 using Volo.Abp.Domain.Services;
 using Volo.Abp.IO;
@@ -15,7 +16,11 @@ namespace Volo.Docs.FileSystem.Documents
 
         public async Task<Document> GetDocument(Project project, string documentName, string version)
         {
-            var path = Path.Combine(project.GetFileSystemPath(), documentName);
+            var projectFolder = project.GetFileSystemPath();
+            var path = Path.Combine(projectFolder, documentName);
+
+            CheckDirectorySecurity(projectFolder, path);
+            
             var content = await FileHelper.ReadAllTextAsync(path);
             var localDirectory = "";
 
@@ -43,8 +48,23 @@ namespace Volo.Docs.FileSystem.Documents
 
         public async Task<DocumentResource> GetResource(Project project, string resourceName, string version)
         {
-            var path = Path.Combine(project.GetFileSystemPath(), resourceName);
+            var projectFolder = project.GetFileSystemPath();
+            var path = Path.Combine(projectFolder, resourceName);
+
+            if (!DirectoryHelper.IsSubDirectoryOf(projectFolder, path))
+            {
+                throw new SecurityException("Can not get a resource file out of the project folder!");
+            }
+
             return new DocumentResource(await FileHelper.ReadAllBytesAsync(path));
         }
+
+        private static void CheckDirectorySecurity(string projectFolder, string path)
+        {
+            if (!DirectoryHelper.IsSubDirectoryOf(projectFolder, path))
+            {
+                throw new SecurityException("Can not get a resource file out of the project folder!");
+            }
+        }
     }
 }

modules/docs/src/Volo.Docs.Web/Areas/Documents/DocumentResourceController.cs

@@ -24,7 +24,6 @@ namespace Volo.Docs.Areas.Documents
 
         [HttpGet]
         [Route("")]
-        //[Produces(MimeTypes.Image.Jpeg, MimeTypes.Image.Png, MimeTypes.Image.Gif)]
         public async Task<FileResult> GetResource(GetDocumentResourceInput input)
         {
             input.Name = input.Name.RemovePreFix("/");