[HOTFIX] Validate interpreter library lookup

[jongyoul]

What is this PR for?

This PR makes interpreter library lookup more robust and predictable.

The previous lookup used the interpreter setting name directly as the on-disk directory, while dependency repositories are stored by setting ID. The updated lookup resolves the registered interpreter setting first, uses its ID for the repository, and returns only direct, regular JAR entries expected by the library synchronization flow. Missing and unsupported entries are ignored.

This also preserves compatibility when an interpreter setting name differs from its setting ID.

What type of PR is it?

Hot Fix

Todos

• Validate interpreter and library lookup inputs
• Resolve repositories through registered interpreter settings
• Preserve setting-name-to-setting-ID compatibility
• Add unit tests for accepted and ignored entries

What is the Jira issue?

N/A

How should this be tested?

./mvnw -pl zeppelin-server \
  -Dtest=RemoteInterpreterEventServerTest,RemoteInterpreterEventServerLibraryTest test

./mvnw -pl zeppelin-server -DskipTests \
  org.apache.rat:apache-rat-plugin:check -Prat

The unit tests cover registered JAR retrieval and metadata, setting-name-to-setting-ID resolution, unsupported lookup inputs, unregistered settings, non-JAR files, directories, and symbolic links.

Screenshots (if appropriate)

N/A

Questions:

• Does the license files need to update? No
• Is there breaking changes for older versions? No
• Does this needs documentation? No

[Copilot]

Pull request overview

This hotfix hardens interpreter library lookup in zeppelin-server by resolving the interpreter’s dependency repository via the registered InterpreterSetting (using its setting ID), and by filtering lookups to direct, regular .jar files to better align with the library sync flow and avoid path-traversal / symlink escape cases.

Changes:

• Resolve interpreter local repository via InterpreterSettingManager.getInterpreterSettingByName(...) and use InterpreterSetting#getId() as the on-disk repository directory.
• Restrict library reads/metadata listing to single-segment, direct .jar regular files; reject traversal, multi-segment inputs, directories, and symlinks.
• Add focused unit tests covering accepted entries and ignored/rejected inputs (including traversal and symlink escapes).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
zeppelin-server/src/main/java/org/apache/zeppelin/interpreter/RemoteInterpreterEventServer.java	Reworks library repository + file resolution to be setting-ID-based and path-safe, and switches listing/reading to java.nio.file with validation.
zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/RemoteInterpreterEventServerLibraryTest.java	Adds unit coverage for the new repository resolution and for accepted vs ignored/rejected library entries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.