Potential fix for code scanning alert no. 114: Uncontrolled data used in path expression

[fugerit79]

Potential fix for https://github.com/fugerit-org/fj-doc/security/code-scanning/114

To fix this, we need to ensure that every time user input is used to construct a file or folder path, it is validated to prevent traversals and keep the output within authorized boundaries. The most robust approach is to check that the resolved/normalized path is strictly within a designated base directory (e.g., the created project temp folder).

Specifically:

• In FeatureFacade.copyFlavourList and the downstream methods (copyResourcesList, copyFile, insureParent), ensure that the baseFolder and all resulting file operations are within an authorized area.
• In FeatureFacade.copyFile, before creating any directories or files, resolve the file (output location) and check that it still resides in (is a descendant of) baseFolder (or projectFolder), after normalization.
• If not, throw an exception and abort.

Implementation:

• Add a helper method (e.g., checkIfInBaseFolder(File baseFolder, File file)).
• Use Java's Path#normalize and Path#toAbsolutePath, and check that file is a descendant of baseFolder.
• Call this validation in copyFile and/or insureParent (or both, for clarity), before actual creation or writing.

Affected file and methods:

• fj-doc-maven-plugin/src/main/java/org/fugerit/java/doc/project/facade/FeatureFacade.java: add helper method, call validation in copyFile and insureParent.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud