Fix critical security vulnerabilities: dependency CVEs, injection attacks, and SSRF

[Copilot]

Remediated multiple critical security vulnerabilities across the application including outdated dependencies with known CVEs, command injection, SQL injection, and SSRF attack vectors.

Dependency Upgrades

• commons-text: 1.9 → 1.10.0 (CVE-2022-42889 - Text4Shell RCE)
• log4j-core: 2.3 → 2.23.1 (CVE-2021-44228 - Log4Shell RCE)
• mysql-connector-java: 5.1.42 → 8.0.33 (multiple authentication/injection CVEs)

Command Injection Prevention

Replaced Runtime.getRuntime().exec() with ProcessBuilder and input validation:

// Before: Direct string concatenation
String find = "find " + command;
Runtime.getRuntime().exec(find);

// After: Validated input with ProcessBuilder
if (!command.matches("[a-zA-Z0-9\\s\\-_./]+")) {
    throw new IllegalArgumentException("Invalid characters");
}
ProcessBuilder pb = new ProcessBuilder(command.split("\\s+"));

SQL Injection Prevention

Converted string concatenation to parameterized PreparedStatements:

// Before: String concatenation
String query = String.format("SELECT * FROM CUSTOMERS WHERE LAST='%s' AND PASSWORD='%s'", last, pass);
stmt.executeQuery(query);

// After: Parameterized query
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM CUSTOMERS WHERE LAST=? AND PASSWORD=?");
stmt.setString(1, last);
stmt.setString(2, pass);

Applied to all query methods in BooksServlet.java including IN clause handling with dynamic parameter binding.

SSRF Protection

Added URL validation and private network blocking:

private boolean isInternalAddress(String host) {
    // Blocks localhost, 10.x, 192.168.x, 172.16-31.x, link-local, metadata endpoints
    // Consolidated from duplicate validation logic
}

Validates protocol restrictions (HTTPS-only) and hostname format before connection attempts.

Additional Hardening

• Sanitized error messages to prevent information disclosure
• Added .gitignore for build artifacts

Original prompt

Hey I found a bunch of secuirty issues. Go solve them

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.