improve isatab parsing

[tballison]

Thanks for your contribution to Apache Tika! Your help is appreciated!

Before opening the pull request, please verify that

• there is an open issue on the Tika issue tracker which describes the problem or the improvement. We cannot accept pull requests without an issue because the change wouldn't be listed in the release notes.
• the issue ID (TIKA-XXXX)
  • is referenced in the title of the pull request
  • and placed in front of your commit messages surrounded by square brackets ([TIKA-XXXX] Issue or pull request title)
• commits are squashed into a single one (or few commits for larger changes)
• Tika is successfully built and unit tests pass by running ./mvnw clean test
• there should be no conflicts when merging the pull request branch into the recent main branch. If there are conflicts, please try to rebase the pull request branch on top of a freshly pulled main branch
• if you add new module that downstream users will depend upon add it to relevant group in tika-bom/pom.xml.

We will be able to faster integrate your pull request if these conditions are met. If you have any questions how to fix your problem or about using Tika in general, please sign up for the Tika mailing list. Thanks!

[Copilot]

Pull request overview

This PR hardens ISA-Tab parsing by resolving assay file names relative to the configured ISA-Tab directory, preventing simple ../ path traversal from investigation metadata, and adds core path-resolution utilities/tests to support that behavior.

Changes:

• Add FilenameUtils.resolveWithin(Path dir, String name) to safely resolve child paths while rejecting ..-based escapes.
• Update ISArchiveParser to resolve assay files via resolveWithin(...) instead of string concatenation.
• Add targeted tests for both the new utility and ISA-Tab parsing behavior when assay names attempt to escape the directory.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tika-parsers/tika-parsers-extended/tika-parser-scientific-module/src/main/java/org/apache/tika/parser/isatab/ISArchiveParser.java	Uses FilenameUtils.resolveWithin to constrain assay file resolution to the ISA-Tab directory.
tika-parsers/tika-parsers-extended/tika-parser-scientific-module/src/test/java/org/apache/tika/parser/isatab/ISArchiveParserTest.java	Adds a regression test ensuring ../ assay references don’t read sibling/outside files.
tika-core/src/main/java/org/apache/tika/io/FilenameUtils.java	Introduces resolveWithin(...) helper for containment-checked path resolution.
tika-core/src/test/java/org/apache/tika/io/FilenameUtilsTest.java	Adds unit tests validating containment behavior and normalization edge cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.