Description: The OpenLibrariesCommand accepts arbitrary file paths from HTTP requests without
validation, allowing attackers to potentially access sensitive files outside intended
directories through path traversal attacks (e.g., ../../etc/passwd).
OpenLibrariesCommand.java [21-23]

List<Path> pathList = paths.stream()
                           .map(Path::of)
                           .toList();

Description: UI commands from potentially untrusted sources (HTTP server) are executed on the JavaFX
application thread without authentication or authorization checks, allowing remote
attackers to manipulate the UI and potentially access sensitive data.
JabRefFrame.java [697-702]

Platform.runLater(() -> {
    if (uiCommands.stream().anyMatch(UiCommand.Focus.class::isInstance)) {
        mainStage.toFront();
    }
    viewModel.handleUiCommands(uiCommands);
});

Description: The addBibtex endpoint accepts arbitrary BibTeX content without validation or
sanitization, potentially allowing injection of malicious code or data that could be
executed when the library is processed or displayed.
EntriesResource.java [50-59]

@Consumes(MediaTypes.APPLICATION_BIBTEX)
public void addBibtex(@PathParam("id") String id, String bibtex) {
    if (uiMessageHandler == null) {
        throw new BadRequestException("Only possible in GUI mode.");
    }
    if (!"current".equals(id)) {
        throw new BadRequestException("Only currently selected library possible");
    }
    uiMessageHandler.handleUiCommands(List.of(new UiCommand.AppendBibTeXToCurrentLibrary(bibtex)));
}

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Exception details exposed: The error handler returns e.getMessage() directly to the client, potentially exposing
internal implementation details or stack trace information.

    return Response.serverError().entity(e.getMessage()).build();
}

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Missing input validation: The bibtex parameter is accepted without validation or sanitization before being passed to
AppendBibTeXToCurrentLibrary, potentially allowing malicious BibTeX content injection.

public void addBibtex(@PathParam("id") String id, String bibtex) {
    if (uiMessageHandler == null) {
        throw new BadRequestException("Only possible in GUI mode.");
    }
    if (!"current".equals(id)) {
        throw new BadRequestException("Only currently selected library possible");
    }
    uiMessageHandler.handleUiCommands(List.of(new UiCommand.AppendBibTeXToCurrentLibrary(bibtex)));

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing null check: The code accesses citationKeyOptional.get() without verifying the Optional is present,
which could throw NoSuchElementException if the Optional is empty.

String citationKey = citationKeyOptional.get();
if (!keysToSelect.contains(citationKey)) {

Learn more about managing compliance generic rules or creating your own custom rules

-                if (firstFoundTab != null) {
+                if (firstFoundTab == null) {

Fix the condition for setting firstFoundTab from if (firstFoundTab != null) to
if (firstFoundTab == null) to correctly focus the UI on the first tab with a
found entry.

jabgui/src/main/java/org/jabref/gui/frame/JabRefFrameViewModel.java [383-420]

 @NullMarked
 private void selectEntries(List<String> entryKeys) {
     // check current library tab first
     LibraryTab currentLibraryTab = tabContainer.getCurrentLibraryTab();
     List<LibraryTab> sortedTabs = tabContainer.getLibraryTabs().stream()
                                               .sorted(Comparator.comparing(tab -> tab != currentLibraryTab))
                                               .toList();
     Set<String> keysToSelect = new HashSet<>(entryKeys);
     LibraryTab firstFoundTab = null;
     for (LibraryTab libraryTab : sortedTabs) {
         List<BibEntry> entrysToSelectInCurrentTab = new ArrayList<>(keysToSelect.size());
         for (BibEntry entry : libraryTab.getDatabase()
                                         .getEntries()) {
             Optional<String> citationKeyOptional = entry.getCitationKey();
             if (citationKeyOptional.isEmpty()) {
                 continue;
             }
             String citationKey = citationKeyOptional.get();
             if (!keysToSelect.contains(citationKey)) {
                 continue;
             }
-            if (firstFoundTab != null) {
+            if (firstFoundTab == null) {
                 firstFoundTab = libraryTab;
             }
             LOGGER.debug("Found entry {} in library tab {}", citationKey, libraryTab);
             keysToSelect.remove(citationKey);
             entrysToSelectInCurrentTab.add(entry);
         }
         libraryTab.clearAndSelect(entrysToSelectInCurrentTab);
     }
     LOGGER.trace("End of loop");
     if (firstFoundTab != null) {
         tabContainer.showLibraryTab(firstFoundTab);
     }
     for (String key : keysToSelect) {
         dialogService.notify(Localization.lang("Citation key '%0' to select not found in open libraries.", key));
     }
 }

[Suggestion processed]

+        if (bibtex == null || bibtex.isBlank()) {
+            throw new BadRequestException("BibTeX data must not be empty.");
+        }

Add a validation check in the addBibtex method to ensure the bibtex string is
not null or blank, throwing a BadRequestException if it is.

jabsrv/src/main/java/org/jabref/http/server/resources/EntriesResource.java [49-59]

 @POST
 @Consumes(MediaTypes.APPLICATION_BIBTEX)
 public void addBibtex(@PathParam("id") String id, String bibtex) {
     if (uiMessageHandler == null) {
         throw new BadRequestException("Only possible in GUI mode.");
     }
     if (!"current".equals(id)) {
         throw new BadRequestException("Only currently selected library possible");
     }
+    if (bibtex == null || bibtex.isBlank()) {
+        throw new BadRequestException("BibTeX data must not be empty.");
+    }
     uiMessageHandler.handleUiCommands(List.of(new UiCommand.AppendBibTeXToCurrentLibrary(bibtex)));
 }

[Suggestion processed]

+- REST-API: Added more commands (`selectentries`, `open`, `focus`).
+- REST-API: Added the possibility to trigger the import dialog

Fix the typographical errors: "More added more" should be "Added more" and
"dialogg" should be "dialog".

CHANGELOG.md [18-19]

-- REST-API: More added more commands (`selectentries`, `open`, `focus`).
-- REST-API: Added the possibility to trigger the import dialogg
+- REST-API: Added more commands (`selectentries`, `open`, `focus`).
+- REST-API: Added the possibility to trigger the import dialog

[Suggestion processed]