Fix path traversal vulnerability in product export endpoint

[devin-ai-integration]

Fix path traversal vulnerability in product export endpoint

Summary

Fixed a critical path traversal vulnerability in the /api/products/export/{filename} endpoint that allowed attackers to read arbitrary files on the server. The endpoint previously accepted user-controlled filenames without validation, enabling directory traversal attacks like ../../../etc/passwd.

Changes made:

1. Multi-layer input validation for the filename parameter:

   • Null/empty filename rejection
   • Path traversal sequence blocking (.., /, \)
   • Whitelist regex validation (^[a-zA-Z0-9._-]+$)
   • Canonical path verification to ensure files stay within /tmp/exports/
   • File existence and type checks

2. Fixed information disclosure vulnerability by replacing detailed error messages with generic ones

3. Fixed SonarQube S1075 code smell by externalizing the hardcoded /tmp/exports/ path to application.properties as app.exports.dir

4. Modernized file handling by converting from deprecated File API to Path API with StandardCharsets.UTF_8

5. Added comprehensive test coverage (9 test cases) to verify path traversal protection and achieve >80% code coverage for SonarQube quality gate

Review & Testing Checklist for Human

• CRITICAL: Symlink security - The code uses toRealPath(LinkOption.NOFOLLOW_LINKS) which does NOT resolve symlinks. This could potentially allow a symlink inside /tmp/exports/ to point outside the directory. Consider whether symlinks should be resolved (remove LinkOption.NOFOLLOW_LINKS) or if symlinks should be explicitly blocked.

• Verify whitelist regex - The filename validation uses ^[a-zA-Z0-9._-]+$. Confirm this matches your requirements for valid export filenames. It blocks spaces, special characters, and Unicode.

• Test path traversal attempts - Manually test the endpoint with various attack payloads:

  curl http://localhost:8080/api/products/export/../../../etc/passwd  # Should return 404 (Spring blocks)
  curl http://localhost:8080/api/products/export/bad..name.txt        # Should return 400
  curl http://localhost:8080/api/products/export/test@file.txt        # Should return 400

• Verify export directory configuration - The app.exports.dir property is set to /tmp/exports/ in application.properties. Confirm this is appropriate for your production environment and that the directory exists with proper permissions.

• End-to-end testing - Test the export functionality through the frontend to ensure legitimate use cases still work correctly after the security hardening.

Notes

• All 14 backend tests pass locally
• SonarQube quality gate passes (0 vulnerabilities, 0 bugs, 0 code smells, >80% coverage)
• The fix addresses OWASP A01:2021 - Broken Access Control

Devin Session: https://app.devin.ai/sessions/621fce980cef4368aaebd00fd00ccae9
Requested by: mason.batchelor@cognition.ai (@mbatchelor81)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring