create separate function for path checking

services/clsi/app/coffee/ResourceWriter.coffee

@@ -75,10 +75,8 @@ module.exports = ResourceWriter =
 				callback()
 
 	_writeResourceToDisk: (project_id, resource, basePath, callback = (error) ->) ->
-		path = Path.normalize(Path.join(basePath, resource.path))
-		if (path.slice(0, basePath.length) != basePath)
-			return callback new Error("resource path is outside root directory")
-
+		ResourceWriter.checkPath basePath, resource.path, (error, path) ->
+			return callback(error) if error?
 			mkdirp Path.dirname(path), (error) ->
 				return callback(error) if error?
 				# TODO: Don't overwrite file if it hasn't been modified
@@ -90,4 +88,9 @@ module.exports = ResourceWriter =
 				else
 					fs.writeFile path, resource.content, callback
 
-		
+	checkPath: (basePath, resourcePath, callback) ->
+		path = Path.normalize(Path.join(basePath, resourcePath))
+		if (path.slice(0, basePath.length) != basePath)
+			return callback new Error("resource path is outside root directory")
+		else
+			return callback(null, path)

services/clsi/app/coffee/TikzManager.coffee

@@ -1,5 +1,6 @@
 fs = require "fs"
 Path = require "path"
+ResourceWriter = require "./ResourceWriter"
 logger = require "logger-sharelatex"
 
 # for \tikzexternalize to work the main file needs to match the
@@ -30,7 +31,9 @@ module.exports = TikzManager =
 			return false
 
 	injectOutputFile: (compileDir, mainFile, callback = (error) ->) ->
-		fs.readFile Path.join(compileDir, mainFile), "utf8", (error, content) ->
+		ResourceWriter.checkPath compileDir, mainFile, (error, path) ->
+			return callback(error) if error?
+			fs.readFile path, "utf8", (error, content) ->
 				return callback(error) if error?
 				logger.log compileDir: compileDir, mainFile: mainFile, "copied file to ouput.tex for tikz"
 				# use wx flag to ensure that output file does not already exist

services/clsi/test/unit/coffee/ResourceWriterTests.coffee

@@ -157,6 +157,19 @@ describe "ResourceWriter", ->
 					.calledWith(new Error("resource path is outside root directory"))
 					.should.equal true
 			
+	describe "checkPath", ->
+		describe "with a valid path", ->
+			beforeEach ->
+				@ResourceWriter.checkPath("foo", "bar", @callback)
 
+			it "should return the joined path", ->
+				@callback.calledWith(null, "foo/bar")
+				.should.equal true
 
+		describe "with an invalid path", ->
+			beforeEach ->
+				@ResourceWriter.checkPath("foo", "baz/../../bar", @callback)
 
+			it "should return an error", ->
+				@callback.calledWith(new Error("resource path is outside root directory"))
+				.should.equal true

services/clsi/test/unit/coffee/TikzManager.coffee

@@ -6,6 +6,7 @@ modulePath = require('path').join __dirname, '../../../app/js/TikzManager'
 describe 'TikzManager', ->
 	beforeEach ->
 		@TikzManager = SandboxedModule.require modulePath, requires:
+			"./ResourceWriter": @ResourceWriter = {}
 			"fs": @fs = {}
 			"logger-sharelatex": @logger = {log: () ->}
 
@@ -49,8 +50,13 @@ describe 'TikzManager', ->
 			'''
 			@fs.readFile = sinon.stub().callsArgWith(2, null, @content)
 			@fs.writeFile = sinon.stub().callsArg(3)
+			@ResourceWriter.checkPath = sinon.stub().callsArgWith(2, null, "#{@rootDir}/#{@filename}")
 			@TikzManager.injectOutputFile @rootDir, @filename, @callback
 
+		it "sould check the path", ->
+			@ResourceWriter.checkPath.calledWith(@rootDir, @filename)
+			.should.equal true
+
 		it "should read the file", ->
 			@fs.readFile
 				.calledWith("#{@rootDir}/#{@filename}", "utf8")