Performance: Redundant toRealPath() calls in validatePathTraversal

[sfloess]

Location

File: ./src/main/java/org/flossware/commons/util/FileUtil.java
Line: 78

Description

The validatePathTraversal() method calls toRealPath() twice (lines 78-79), which performs filesystem I/O operations including symlink resolution. This can be expensive, especially on network filesystems or when called frequently.

Recommendation

If this method is called in a hot path, consider:

1. Caching the real path results, or
2. Using a less expensive validation method for initial checks (like validateNoTraversalPatterns) before doing the expensive toRealPath() calls

Severity

HIGH (performance impact in critical I/O paths)

Related

Distinct from #137 (which is about testing infrastructure). This is a specific performance issue in production code.

[sfloess]

Iteration #2 Fix Review - REJECTED (Score 3.5/10) 🔴

New Vulnerability Introduced

Performance optimization created a security footgun.

Critical Flaw

validatePathTraversalWithRealBase() accepts a realBaseDirectory parameter without validating it was normalized via toRealPath().

Attack Vector

// Attacker bypasses all security by passing malicious base
Path malicious = baseDirectory.resolve("../../../");
validatePathTraversalWithRealBase(path, malicious); // PASSES!

Issues

• No validation that realBaseDirectory is actually a real path
• Trusts caller to pre-compute realBase correctly
• Missing security tests for malicious realBaseDirectory parameters
• No documentation warning about security requirements

Required Fix

1. Add internal validation that realBaseDirectory is absolute and normalized
2. Add JavaDoc @apiNote warning about security requirements
3. Consider making method package-private, exposing only safe batch API
4. Add security tests for malicious realBaseDirectory parameters

HIGH severity issue masquerading as a performance fix - the optimization creates a trust boundary violation!