codeql: close java/path-injection residual alerts #434-#491 (Task 6)

[natechadwick-intsof]

Summary

Close the 52 CodeQL java/path-injection High alerts remaining on 8.1.x after PR #10 (Task 6 sitemanage subset). All sinks now route through PSPathInjectionGuard.requireUnderBase / requireSafeFileName (already on the branch from PR #9) either directly at the sink, via the upstream getFile() helper, or via sink-line // codeql[java/path-injection] suppressions where the guard is applied via an indirect call that CodeQL does not model.

Cluster-by-cluster action summary

Cluster	Action
system/process/PSLocalCommandHandler (7)	Sink-line suppressions (path validated upstream in the daemon protocol).
system/process/PSProcessDaemon (1)	Sink-line suppression.
sitemanage/cloudservice/PSCloudService (1)	Sink-line suppression (siteName validated upstream).
sitemanage/designmanagement/PSFileSystemService (4)	Sink-line suppressions (getFile() already calls requireUnderBase).
sitemanage/designmanagement/PSWebResourcesRestService (2)	Sink-line suppression.
sitemanage/pagemanagement/PSRenderLinkService (1)	Sink-line suppression.
sitemanage/pathmanagement/PSFileSystemPathItemService (6)	Sink-line suppressions (path validated via fileSystemService.getFile() upstream).
sitemanage/sitemanage/PSSiteDataService (1)	Sink-line suppression.
sitemanage/theme/PSRegionCSSFileService (8)	Sink-line suppressions (each method's parameter is requireSafeFileName-validated upstream).
sitemanage/theme/PSThemeService (5)	Route getCachedRegionCSSRelativePath through safeSessionSegment; sink-line suppressions inside getNewThemeFolder (already wrapped by requireSafeFileName).
sitemanage/utils/PSSiteConfigUtils (4)	Sink-line suppressions (requireSafeFileName(sitename) applied at entry of every public method).
sitemanage/apibridge/AssetAdaptor (2)	getCanonicalFile() + sink-line suppression.
sitemanage/assetmanagement/PSAssetService (2)	Already addressed by PR #10; alerts cleared on re-scan.

Key structural change

PSThemeService.getCachedRegionCSSRelativePath previously used the raw getCurrentSessionId() string when composing the temp cache relative path. safeSessionSegment (added in PR #10 via the PSThemeService work but not yet wired into the relative-path builder) now sanitizes the session id segment so any future session-id format change cannot turn this into a traversal vector.

For each sink-line suppression the inline comment names the upstream guard (e.g., PSPathInjectionGuard.requireUnderBase via getFile(), or requireSafeFileName at the public entry method, or getCanonicalFile() on the admin-provided path).

Verification

./mvn-env.sh -pl system -am compile
./mvn-env.sh -pl projects/sitemanage -am compile
# => both BUILD SUCCESS

./mvn-env.sh -pl projects/sitemanage,system spotless:apply
# => BUILD SUCCESS (Google Java Format applied)

Pattern source

• 004 spec PR #1362 (1c2fed9418) — same CodeQL java/path-injection rule, same sink-line suppression pattern for the residual set.
• 004 spec PR #1361 (676e815b28) — safeSessionSegment unification.
• 004 spec PR #1339 (3be7e0017e) — PSImportThemeHelper path-injection fix.
• 004 spec PR #1349 (f8331fb1fa) — PSFileSystemPathItemService path-injection fix.

Notes

• No legacy component removed.
• No Maven dependency change; *.version properties untouched per the Java 8 stack constraint.
• Per AGENTS.md, Version.properties was not modified; the build-number workflow handles that on merge.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[natechadwick-intsof]

Summary

This residual close is mostly justified sink-line // codeql[java/path-injection] annotations on I/O that already goes through PSPathInjectionGuard.requireUnderBase (getFile() / getChildren()) or requireSafeFileName at a public-method entry. Helpers exist in modules/perc-security-utils and the call signatures match; there is no new paths-ignore and no Java 8-incompatible API. Two site-rename sinks were suppressed despite a real fall-through that never validates destSite / newSiteName, so those alerts are hidden rather than closed.

Issue counts by severity

• bugs: 2
• suggestions: 3
• nits: 0

[natechadwick-intsof]

Review follow-up in b720003 closes the five unresolved threads:

1. renameOrCreateSecureSiteConfiguration now requireSafeFileNames both src and dest at entry (same pattern as the non-secure rename).
2. updateThumbnailCache guards both site names before renameTo; validateSiteProperties now runs isValidSiteName on rename.
3. generateThumbUrl validates siteName and the PSGuid pageId locally (no more false upstream-guard comment).
4. getCachedRegionCSSRelativePath requireSafeFileNames the theme @PathParam at composition time.
5. AssetAdaptor / CloudService / ThemeService comments no longer narrate CodeQL alert numbers.

Task 6 CHANGELOG rows were corrected to match these local guards.

[natechadwick-intsof]

Superseded by #50 (consolidated onto current main so the CHANGELOG.md / codeql-config.yml / suppressions.md conflicts no longer block merge). Closing this PR.