fix: guard segment info paths against traversal

[FrankChen021]

Summary

• add a shared helper that resolves a relative path only when its normalized result remains beneath the intended directory
• reject absolute paths, including absolute paths that happen to point beneath the configured directory
• use the helper consistently for complete and partial segment info-file writes and deletion
• cover legitimate nested paths, .. traversal, absolute paths, and preservation of an out-of-directory sentinel

Root cause

SegmentLocalCacheManager constructed info-file paths directly from DataSegment#getId(). A segment identifier includes externally supplied data-source text, so a crafted identifier containing parent components could make the delete sink reported by CodeQL alert #7450 resolve outside the owned info_dir. The same construction was used by the corresponding info-file write paths.

Fix and impact

Segment info paths are now normalized and required to remain under the configured info directory before any file operation. Absolute paths are rejected explicitly. Normal relative paths, including legitimate nested relative paths, continue to resolve normally. This affects only invalid segment identifiers that would escape the configured info directory.

Validation

• mvn -ntp -Pskip-static-checks -pl processing -DskipITs -Dtest=FileUtilsTest test — 20 tests passed
• mvn -ntp -Pskip-static-checks -pl server -am -DskipITs -Dtest=SegmentLocalCacheManagerTest -Dsurefire.failIfNoSpecifiedTests=false test — 31 tests passed
• mvn -ntp -pl processing,server -DskipTests validate — Checkstyle, PMD, and Maven enforcer passed for both modules
• git diff --check

[FrankChen021]

The failing non-transactional KafkaIndexFaultToleranceTest.test_supervisorRecovers_afterSuspendResume appears to be an unrelated Kafka test flake during the initial ingestion wait. PR #19824 addresses the likely initial topic-leader readiness race. PR #19817 additionally waits for non-transactional producer sends, so delivery failures are no longer silently deferred.

[Copilot]

Pull request overview

This PR hardens segment info-file path handling in SegmentLocalCacheManager by ensuring paths derived from DataSegment#getId() cannot escape the configured info_dir, preventing path traversal and unsafe absolute-path usage.

Changes:

• Added FileUtils.resolveFileWithinDirectory(...) to resolve relative paths safely under a base directory (rejecting traversal and absolute paths).
• Updated SegmentLocalCacheManager to use the helper for full and partial info-file writes and for deletion.
• Added unit tests covering nested paths, traversal, and absolute path rejection.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
processing/src/main/java/org/apache/druid/java/util/common/FileUtils.java	Adds helper to safely resolve relative paths under a directory.
processing/src/test/java/org/apache/druid/java/util/common/FileUtilsTest.java	Adds tests for safe resolution and rejection of traversal/absolute paths.
server/src/main/java/org/apache/druid/segment/loading/SegmentLocalCacheManager.java	Routes all segment info-file path construction through the safe resolver.
server/src/test/java/org/apache/druid/segment/loading/SegmentLocalCacheManagerTest.java	Adds regression test for traversal-based segment identifiers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.