Validate that root paths are absolute and normalized.

pkg/analysis_server/lib/src/domain_analysis.dart

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library domain.analysis;
 
 import 'dart:async';
 import 'dart:core' hide Resource;
 
 import 'package:analysis_server/plugin/analysis/analysis_domain.dart';
@@ skipping 157 matching lines @@
   /**
    * Implement the `analysis.getReachableSources` request.
    */
   Response getReachableSources(Request request) {
     AnalysisGetReachableSourcesParams params =
         new AnalysisGetReachableSourcesParams.fromRequest(request);
     ContextSourcePair pair = server.getContextSourcePair(params.file);
     if (pair.context == null || pair.source == null) {
       return new Response.getReachableSourcesInvalidFile(request);
     }
-    Map<String, List<String>> sources = new ReachableSourceCollector(
-        pair.source, pair.context).collectSources();
+    Map<String, List<String>> sources =
+        new ReachableSourceCollector(pair.source, pair.context)
+            .collectSources();
     return new AnalysisGetReachableSourcesResult(sources)
         .toResponse(request.id);
   }
 
   @override
   Response handleRequest(Request request) {
     try {
       String requestName = request.method;
       if (requestName == ANALYSIS_GET_ERRORS) {
         return getErrors(request);
@@ skipping 48 matching lines @@
       server.reanalyze(rootResources);
     }
     return new AnalysisReanalyzeResult().toResponse(request.id);
   }
 
   /**
    * Implement the 'analysis.setAnalysisRoots' request.
    */
   Response setAnalysisRoots(Request request) {
     var params = new AnalysisSetAnalysisRootsParams.fromRequest(request);
+    List<String> includedPathList = params.included;
+    List<String> excludedPathList = params.excluded;
+    // validate
+    for (String path in includedPathList) {
+      if (!server.isValidFilePath(path)) {
+        return new Response.invalidFilePathFormat(request, path);
+      }
+    }
+    for (String path in excludedPathList) {
+      if (!server.isValidFilePath(path)) {
+        return new Response.invalidFilePathFormat(request, path);
+      }
+    }
     // continue in server
-    server.setAnalysisRoots(request.id, params.included, params.excluded,
-        params.packageRoots == null ? {} : params.packageRoots);
+    server.setAnalysisRoots(request.id, includedPathList, excludedPathList,
+        params.packageRoots ?? <String, String>{});
     return new AnalysisSetAnalysisRootsResult().toResponse(request.id);
   }
 
   /**
    * Implement the 'analysis.setGeneralSubscriptions' request.
    */
   Response setGeneralSubscriptions(Request request) {
     AnalysisSetGeneralSubscriptionsParams params =
         new AnalysisSetGeneralSubscriptionsParams.fromRequest(request);
     server.setGeneralAnalysisSubscriptions(params.subscriptions);
@@ skipping 79 matching lines @@
     }
   }
 }
 
 /**
  * An implementation of [AnalysisDomain] for [AnalysisServer].
  */
 class AnalysisDomainImpl implements AnalysisDomain {
   final AnalysisServer server;
 
-  final Map<ResultDescriptor,
-          StreamController<engine.ComputedResult>> controllers =
+  final Map<ResultDescriptor, StreamController<engine.ComputedResult>>
+      controllers =
       <ResultDescriptor, StreamController<engine.ComputedResult>>{};
 
   AnalysisDomainImpl(this.server) {
     server.onContextsChanged.listen((ContextsChangedEvent event) {
       event.added.forEach(_subscribeForContext);
     });
   }
 
   @override
   Stream<engine.ComputedResult> onResultComputed(ResultDescriptor descriptor) {
@@ skipping 24 matching lines @@
       context.onResultComputed(descriptor).listen((result) {
         StreamController<engine.ComputedResult> controller =
             controllers[result.descriptor];
         if (controller != null) {
           controller.add(result);
         }
       });
     }
   }
 }