🔴 Critical/High: Fix 3 AI SAST findings (Tomcat privileged context, path traversal, password logging)

files/context.xml

@@ -15,10 +15,6 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" >
-<!--
-  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
-         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
+<Context antiResourceLocking="false" privileged="false" >
   <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>
--->
 </Context>

src/main/java/com/visualpathit/account/controller/FileUploadController.java

@@ -3,6 +3,7 @@
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Path;
 import java.util.List;
 
 import org.slf4j.Logger;
@@ -38,21 +39,31 @@ public final String upload(final Model model) {
 	String uploadFileHandler(@RequestParam("name") String name,@RequestParam("userName") String userName,
 			@RequestParam("file") MultipartFile file) {
 
-		System.out.println("Called the upload file :::" );
+		logger.info("Called the upload file");
 		if (!file.isEmpty()) {
 			try {
+				// Reject names containing path separators or traversal sequences to
+				// prevent writing outside the intended upload directory.
+				if (name == null || name.isEmpty() || name.contains("/") || name.contains("\\")
+						|| name.contains("..") || !name.matches("[A-Za-z0-9_\\-]+")) {
+					return "Upload rejected: invalid file name.";
+				}
+
 				byte[] bytes = file.getBytes();
 
 				// Creating the directory to store file
 				String rootPath = System.getProperty("catalina.home");
-				System.out.println("Path ::::" +rootPath);
 				File dir = new File(rootPath + File.separator + "tmpFiles");
 				if (!dir.exists())
 					dir.mkdirs();
 
-				// Create the file on server
-				File serverFile = new File(dir.getAbsolutePath()
-						+ File.separator + name+".png");
+				// Canonicalize the target path and confirm it stays inside the upload directory.
+				File serverFile = new File(dir.getAbsolutePath() + File.separator + name + ".png");
+				Path canonicalDir = dir.toPath().toRealPath();
+				Path canonicalFile = serverFile.getCanonicalFile().toPath();
+				if (!canonicalFile.startsWith(canonicalDir)) {
+					return "Upload rejected: path traversal detected.";
+				}
 				//image saving 
 				User user = userService.findByUsername(userName);
 				user.setProfileImg(name +".png");

src/main/java/com/visualpathit/account/controller/UserController.java

@@ -48,7 +48,6 @@ public final String registration(final @ModelAttribute("userForm") User userForm
         if (bindingResult.hasErrors()) {
             return "registration";
         }
-        System.out.println("User PWD:"+userForm.getPassword());
         userService.save(userForm);
 
         securityService.autologin(userForm.getUsername(), userForm.getPasswordConfirm());