• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing null validation: The method getFileExtension at line 80 does not validate if fileName parameter is null
before calling lastIndexOf, which could result in NullPointerException.

public static Optional<String> getFileExtension(String fileName) {
    int dotPosition = fileName.lastIndexOf('.');
    if ((dotPosition > 0) && (dotPosition < (fileName.length() - 1))) {
        return Optional.of(fileName.substring(dotPosition + 1).trim().toLowerCase(Locale.ROOT));
    } else {
        return Optional.empty();
    }

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Potential path traversal: The method getFileNameFromUrl at line 161 extracts filename from URL without validating
against path traversal attacks (e.g., '../../../etc/passwd').

public static String getFileNameFromUrl(String url) {
    String fileName = url.substring(url.lastIndexOf('/') + 1);
    if (fileName.isBlank()) {
        fileName = "downloaded.pdf";
    }
    return FileUtil.getValidFileName(fileName);
}

Learn more about managing compliance generic rules or creating your own custom rules

The revert introduced inconsistent file and path handling. It replaced efficient
Files.isDirectory(path) calls with the less robust path.toFile().isDirectory()
and introduced new, less robust methods for getting filenames from URLs. These
changes should be reviewed for consistency and correctness.

Examples:

        Predicate<String> isDirectory = path -> Path.of(path).toFile().isDirectory();
        latexDirectoryValidator = new FunctionBasedValidator<>(latexFileDirectory, isDirectory,
                ValidationMessage.error(Localization.lang("Please enter a valid file path.")));

    public static String getFileNameFromUrl(String url) {
        String fileName = url.substring(url.lastIndexOf('/') + 1);
        if (fileName.isBlank()) {
            fileName = "downloaded.pdf";
        }
        return FileUtil.getValidFileName(fileName);
    }

Solution Walkthrough:

Before:

// In ParseLatexDialogViewModel.java
Predicate<String> isDirectory = path -> Files.isDirectory(Path.of(path));
...
if ((directory == null) || !Files.isDirectory(directory)) { ... }
...
fileListPartition = filesStream.collect(Collectors.partitioningBy(Files::isDirectory));

// In FileUtil.java
public static Optional<String> getFileNameFromUrl(String link) {
    int slash = link.lastIndexOf('/');
    slash = (slash >= 0 ? slash + 1 : 0);
    int query = link.indexOf('?', slash);
    query = (query >= 0 ? query : link.length());
    if (slash < query) {
        return Optional.of(getValidFileName(link.substring(slash, query)));
    } else {
        return Optional.empty();
    }
}

After:

// In ParseLatexDialogViewModel.java
Predicate<String> isDirectory = path -> Path.of(path).toFile().isDirectory();
...
if ((directory == null) || !directory.toFile().isDirectory()) { ... }
...
fileListPartition = filesStream.collect(Collectors.partitioningBy(path -> path.toFile().isDirectory()));

// In URLUtil.java
public static String getFileNameFromUrl(String url) {
    String fileName = url.substring(url.lastIndexOf('/') + 1);
    if (fileName.isBlank()) {
        fileName = "downloaded.pdf";
    }
    return FileUtil.getValidFileName(fileName);
}