Layertools may extract entries outside of the destination path

[trgpa]

The check for subdirectory in ExtractCommand.java will always return true because getAbsolutePath does not resolve .. and symlinks.
This PR uses getCanonicalPath and adds a file separator at the end of destination path to avoid treating directories with the same prefix as subdirectories (e.g /foo, /foobar).

[wilkinsona]

Thanks for the proposal but I am not sure that this change is necessary due to this existing line:

spring-boot/spring-boot-project/spring-boot-tools/spring-boot-jarmode-layertools/src/main/java/org/springframework/boot/jarmode/layertools/ExtractCommand.java

Line 89 in 9d11781

String path = StringUtils.cleanPath(entry.getName());

Cleaning the path should resolve any .. entries. If you've seen a scenario where this isn't sufficient, perhaps you could add a test demonstrating the problem?

[wilkinsona]

No, it is necessary. For example, the path for a e/../../../../../e.jar entry in the jar becomes ../../../../e.jar.

[wilkinsona]

Thanks very much for making your first contribution to Spring Boot, @trungPa.