Fix: Credential masking and add path traversal validation

fcli-core/fcli-aviator/src/main/java/com/fortify/cli/aviator/_common/config/admin/cli/mixin/AviatorAdminPrivateKeyResolverMixin.java

@@ -16,13 +16,16 @@
 
 import com.fortify.cli.common.cli.mixin.CommonOptionMixins.AbstractTextResolverMixin;
 import com.fortify.cli.common.exception.FcliSimpleException;
+import com.fortify.cli.common.log.LogSensitivityLevel;
+import com.fortify.cli.common.log.MaskValue;
 
 import lombok.Getter;
 import picocli.CommandLine.Option;
 
 /**
  * Mixin for resolving an Aviator admin private key from various sources (file, string, environment variable).
  */
+@MaskValue(sensitivity = LogSensitivityLevel.high, description = "AVIATOR ADMIN PRIVATE KEY")
 public class AviatorAdminPrivateKeyResolverMixin extends AbstractTextResolverMixin {
     @Option(names = {"--private-key", "-p"}, descriptionKey = "fcli.aviator.admin-config.create.private-key", paramLabel = "source", required = true, order = 3)
     @Getter private String privateKeySource;

fcli-core/fcli-aviator/src/main/java/com/fortify/cli/aviator/_common/session/user/cli/mixin/AviatorUserTokenResolverMixin.java

@@ -24,9 +24,9 @@
 /**
  * Mixin for resolving an Aviator user token from various sources (direct string, file, URL, environment variable).
  */
+@MaskValue(sensitivity = LogSensitivityLevel.high, description = "AVIATOR TOKEN")
 public class AviatorUserTokenResolverMixin extends AbstractTextResolverMixin {
     @Option(names = {"--token", "-t"}, descriptionKey = "fcli.aviator.session.login.token", paramLabel = "source", required = true, order = 1)
-    @MaskValue(sensitivity = LogSensitivityLevel.high, description = "AVIATOR TOKEN")
     private String textSource;
 
     @Override

fcli-core/fcli-aviator/src/main/java/com/fortify/cli/aviator/token/cli/cmd/AviatorTokenDeleteCommand.java

@@ -72,7 +72,7 @@ private JsonNode processDeleteResponse(DeleteTokenResponse response, String toke
         ObjectMapper objectMapper = new ObjectMapper();
         ObjectNode deleteTokenNode = objectMapper.createObjectNode();
         deleteTokenNode.put("message", "Token deleted successfully");
-        LOG.info("Token '{}' deleted successfully for email: {}", tokenToDelete, email);
+        LOG.info("Token deleted successfully for email: {}", email);
         return deleteTokenNode;
     }
 

fcli-core/fcli-aviator/src/main/java/com/fortify/cli/aviator/token/cli/cmd/AviatorTokenRevokeCommand.java

@@ -72,7 +72,7 @@ private JsonNode processRevokeResponse(RevokeTokenResponse response, String toke
         ObjectMapper objectMapper = new ObjectMapper();
         ObjectNode revokeTokenNode = objectMapper.createObjectNode();
         revokeTokenNode.put("message", "Token successfully revoked");
-        LOG.info("Token '{}' revoked successfully for email: {}", tokenToRevoke, email);
+        LOG.info("Token revoked successfully for email: {}", email);
         return revokeTokenNode;
     }
 

fcli-core/fcli-tool/src/main/java/com/fortify/cli/tool/_common/helper/ToolInstallationDescriptor.java

@@ -28,6 +28,7 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.formkiq.graalvm.annotations.Reflectable;
+import com.fortify.cli.common.exception.FcliSimpleException;
 import com.fortify.cli.common.json.JsonHelper;
 import com.fortify.cli.common.tool.definitions.helper.ToolDefinitionVersionDescriptor;
 import com.fortify.cli.common.util.FcliDataHelper;
@@ -172,7 +173,17 @@ private static final Path asPath(String dir) {
         return StringUtils.isNotBlank(dir) ? Paths.get(dir) : null;
     }
 
+    private static final void validateVersionString(String version) {
+        if (StringUtils.isBlank(version)) {
+            throw new FcliSimpleException("Version string cannot be blank");
+        }
+        if (!version.matches("[A-Za-z0-9._+-]+")) {
+            throw new FcliSimpleException("Invalid version string: " + version + ". Version must contain only alphanumeric characters, dots, hyphens, underscores, or plus signs.");
+        }
+    }
+
     private static final Path getInstallDescriptorPath(String toolName, String version) {
+        validateVersionString(version);
         return getInstallDescriptorsDirPath(toolName).resolve(version);
     }
 
@@ -181,6 +192,7 @@ private static final Path getInstallDescriptorsDirPath(String toolName) {
     }
 
     private static final Path getInstallDescriptorToolCopyPath(Path installPath, String toolName, ToolDefinitionVersionDescriptor versionDescriptor) {
+        validateVersionString(versionDescriptor.getVersion());
         return installPath.resolve("install-descriptor").resolve(toolName).resolve(versionDescriptor.getVersion());
     }