Add path sanitization and reliability documentation updates

Agent-Logs-Url: https://github.com/schemacrawler/SchemaCrawler/sessions/d783923d-31e1-48fd-944b-ab9fcda0d376

Co-authored-by: sualeh <36505153+sualeh@users.noreply.github.com>

Author: Copilot

RELIABILITY_CHANGES.md

@@ -4,22 +4,30 @@
 
 1. **Hardened credential file handling**
    - Updated:
-     - `/home/runner/work/SchemaCrawler/SchemaCrawler/schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/UserOptions.java`
-     - `/home/runner/work/SchemaCrawler/SchemaCrawler/schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/PasswordOptions.java`
+     - `schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/UserOptions.java`
+     - `schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/PasswordOptions.java`
    - Changes:
      - Normalize the provided path before use.
      - Validate that the path is a **readable regular file**.
      - Read only the **first line** from the file using a buffered reader (instead of loading all lines).
 
-2. **Added targeted regression tests**
+2. **Sanitized generated completion-script file name input**
    - Updated:
-     - `/home/runner/work/SchemaCrawler/SchemaCrawler/schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/UserParserTest.java`
-     - `/home/runner/work/SchemaCrawler/SchemaCrawler/schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/PasswordParserTest.java`
+     - `schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/utility/GenerateCliSupport.java`
+   - Changes:
+     - Reject empty, absolute, traversal-like, and multi-segment values for `--completion-script`.
+     - Ensure the resolved output path stays within the requested output directory.
+
+3. **Added targeted regression tests**
+   - Updated:
+     - `schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/UserParserTest.java`
+     - `schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/PasswordParserTest.java`
    - New tests verify that using a directory path for `--user:file` or `--password:file` fails gracefully.
 
 ## Why these changes are recommended
 
 - **Safer file-system processing:** Explicitly rejecting non-file and unreadable paths avoids ambiguous IO behavior and produces clearer failures.
 - **Improved resilience:** Reading a single credential line avoids unnecessary memory use on unexpectedly large files.
 - **Predictable behavior:** Path normalization and upfront validation reduce edge-case handling surprises.
+- **Input sanitization:** Restricting completion script file names prevents unintended path resolution.
 - **Maintained compatibility:** Existing behavior (using the first line as the credential) is preserved.

schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/utility/GenerateCliSupport.java

@@ -9,6 +9,7 @@
 package schemacrawler.tools.commandline.utility;
 
 import java.io.IOException;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Arrays;
@@ -59,7 +60,7 @@ public void run() {
       boolean isErrored = false;
 
       outputDir = createOutputDirectory();
-      final Path completionScript = outputDir.resolve(completionScriptFilename).toAbsolutePath();
+      final Path completionScript = createCompletionScriptPath();
 
       if (generateAsciiDoc()) {
         isErrored = true;
@@ -82,6 +83,34 @@ protected Path createOutputDirectory() {
       return outputDir.toAbsolutePath();
     }
 
+    private Path createCompletionScriptPath() {
+      final Path outputDirPath = outputDir.toAbsolutePath().normalize();
+      final String filename =
+          completionScriptFilename == null ? "" : completionScriptFilename.trim();
+      final Path scriptFileName;
+      try {
+        scriptFileName = Path.of(filename);
+      } catch (final InvalidPathException e) {
+        throw new IllegalArgumentException(
+            "Completion script file name is invalid <%s>".formatted(completionScriptFilename), e);
+      }
+
+      if (filename.isEmpty()
+          || scriptFileName.isAbsolute()
+          || scriptFileName.getNameCount() != 1
+          || ".".equals(scriptFileName.toString())
+          || "..".equals(scriptFileName.toString())) {
+        throw new IllegalArgumentException(
+            "Completion script file name must be a simple file name");
+      }
+
+      final Path completionScript = outputDirPath.resolve(scriptFileName).normalize();
+      if (!completionScript.startsWith(outputDirPath)) {
+        throw new IllegalArgumentException("Completion script path resolves outside output directory");
+      }
+      return completionScript;
+    }
+
     private CommandLine createCommandLine(final Object commands) {
       final ShellState state = new ShellState();
       final StateFactory stateFactory = new StateFactory(state);