Details
Major Description
In couple of Karaf code, `getCanonicalPath` transforms the path into a canonical form preventing such attack types as `..` in path segments. If the result of `targetDir.getCanonicalPath()` is not slash terminated it allows for partial path traversal.
Consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although it is not the `out` directory.
The terminating slash may be removed in various places. On Linux `println(new File("/var/"))` returns `/var`, but `println(new File("/var", "/"))` - `/var/`, however `println(new File("/var", "/").getCanonicalPath())` - `/var`.