dickschoeller / gedbrowser / 21682026823

95%

master: 96%

Pull #1305

github

Fix SonarQube path construction security issues

- GedDocumentFileLoader: Add path validation to prevent directory traversal in dbName parameter
  - Use Paths.get() for safe path construction
  - Validate database names to exclude path separators and traversal sequences
  - Add tests to verify malicious input handling

- StreamManager: Add path validation to prevent directory traversal in filename parameter
  - Normalize paths to detect bypassed traversal attempts
  - Validate both file and resource paths
  - Add tests for path traversal attacks

- FileSystemStorageService: Ensure resolved paths stay within root directory
  - Normalize resolved path after resolve()
  - Verify normalized path still starts with root location
  - Add comprehensive tests for path validation

All changes include unit tests verifying that malicious input is properly rejected.

2059 of 2362 branches covered (87.17%)

9460 of 9996 relevant lines covered (94.64%)

5.42 hits per line