[NO-ISSUE] Prevent directory escape bypass through repeated URL decoding

[tbonelee]

What is this PR for?

This PR addresses an issue in NotebookService where the notebook path validation only performs a single decoding pass.
This allowed a malicious user to bypass validation by double-encoding the ".." token.
By implementing the repeated decoding, we can prevent this bypass.
Additionally, to prevent excessive decoding attempts, a maximum limit on the number of decoding attempts has been added.

What type of PR is it?

Hot Fix

How should this be tested?

• CI

Questions:

• Does the license files need to update? No
• Is there breaking changes for older versions?
  • There may be minor compatibility issues if a user relies on multiple encoded paths, but this is unlikely in realistic scenarios.
• Does this needs documentation? No

[tbonelee]

cc @jongyoul

[tbonelee]

@pan3793 @Reamer
When you have a moment, could you check this PR? Appreciate it!

[Reamer]

Just a few minor comments. The five attempts seem quite random. But I think it's good that an error message is thrown afterwards.

[tbonelee]

@Reamer Thank you for the feedback! I've added a commit based on your feedback.

I agree that using five attempts feels somewhat arbitrary. However I couldn't think of a better alternative, so I went with this value.
If you have any other suggestions, I'd love to hear them!

[Reamer]

LGTM, let's wait for CI

[pan3793]

I read the change and understand what it does, but I don't understand why should this change.
And please create a JIRA ticket for it, if you think this involves CVE which is not suitable to discuss publicly, you can write a detailed message to private@zeppelin.apache.org