Use FileInputResource for credential file reading; revert GenerateCliSupport changes

Agent-Logs-Url: https://github.com/schemacrawler/SchemaCrawler/sessions/0c7f56ce-dcc2-489e-80ce-3bf852ca475d

Co-authored-by: sualeh <36505153+sualeh@users.noreply.github.com>

Author: Copilot

RELIABILITY_CHANGES.md

@@ -11,14 +11,7 @@
      - Validate that the path is a **readable regular file**.
      - Read only the **first line** from the file using a buffered reader (instead of loading all lines).
 
-2. **Sanitized generated completion-script file name input**
-   - Updated:
-     - `schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/utility/GenerateCliSupport.java`
-   - Changes:
-     - Reject empty, absolute, traversal-like, and multi-segment values for `--completion-script`.
-     - Ensure the resolved output path stays within the requested output directory.
-
-3. **Added targeted regression tests**
+2. **Added targeted regression tests**
    - Updated:
      - `schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/UserParserTest.java`
      - `schemacrawler-commandline/src/test/java/schemacrawler/test/commandline/command/PasswordParserTest.java`
@@ -29,5 +22,5 @@
 - **Safer file-system processing:** Explicitly rejecting non-file and unreadable paths avoids ambiguous IO behavior and produces clearer failures.
 - **Improved resilience:** Reading a single credential line avoids unnecessary memory use on unexpectedly large files.
 - **Predictable behavior:** Path normalization and upfront validation reduce edge-case handling surprises.
-- **Input sanitization:** Restricting completion script file names prevents unintended path resolution.
+- **Input sanitization via library:** Using `FileInputResource` from `us.fatehi.utility.ioresource` delegates file validation to a shared, well-tested library class.
 - **Maintained compatibility:** Existing behavior (using the first line as the credential) is preserved.

schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/PasswordOptions.java

@@ -17,6 +17,7 @@
 import java.nio.file.Path;
 import picocli.CommandLine.Option;
 import schemacrawler.schemacrawler.exceptions.IORuntimeException;
+import us.fatehi.utility.ioresource.FileInputResource;
 
 public final class PasswordOptions {
 
@@ -89,20 +90,21 @@ private String getPasswordFromFile() {
       return null;
     }
 
-    final Path normalizedPasswordFile = passwordFile.toAbsolutePath().normalize();
-    if (!Files.isRegularFile(normalizedPasswordFile) || !Files.isReadable(normalizedPasswordFile)) {
-      throw new IORuntimeException(
-          "Password could not be read from file <%s> - path is not a readable regular file"
-              .formatted(normalizedPasswordFile));
-    }
-
     try {
-      try (final BufferedReader reader = Files.newBufferedReader(normalizedPasswordFile, UTF_8)) {
+      final FileInputResource inputResource = new FileInputResource(passwordFile);
+      try (final BufferedReader reader = inputResource.openNewInputReader(UTF_8)) {
         return reader.readLine();
       }
     } catch (final IOException e) {
+      // FileInputResource throws IOException for unreadable, non-regular, AND empty files.
+      // If the path is a readable regular file the only reason for the exception is that it is
+      // empty, which means no credential was supplied - return null in that case.
+      final Path path = passwordFile.toAbsolutePath().normalize();
+      if (Files.isRegularFile(path) && Files.isReadable(path)) {
+        return null;
+      }
       throw new IORuntimeException(
-          "Password could not be read from file <%s>".formatted(normalizedPasswordFile), e);
+          "Password could not be read from file <%s>".formatted(passwordFile), e);
     }
   }
 

schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/command/UserOptions.java

@@ -17,6 +17,7 @@
 import java.nio.file.Path;
 import picocli.CommandLine.Option;
 import schemacrawler.schemacrawler.exceptions.IORuntimeException;
+import us.fatehi.utility.ioresource.FileInputResource;
 
 public final class UserOptions {
 
@@ -89,20 +90,20 @@ private String getUserFromFile() {
       return null;
     }
 
-    final Path normalizedUserFile = userFile.toAbsolutePath().normalize();
-    if (!Files.isRegularFile(normalizedUserFile) || !Files.isReadable(normalizedUserFile)) {
-      throw new IORuntimeException(
-          "User could not be read from file <%s> - path is not a readable regular file"
-              .formatted(normalizedUserFile));
-    }
-
     try {
-      try (final BufferedReader reader = Files.newBufferedReader(normalizedUserFile, UTF_8)) {
+      final FileInputResource inputResource = new FileInputResource(userFile);
+      try (final BufferedReader reader = inputResource.openNewInputReader(UTF_8)) {
         return reader.readLine();
       }
     } catch (final IOException e) {
-      throw new IORuntimeException(
-          "User could not be read from file <%s>".formatted(normalizedUserFile), e);
+      // FileInputResource throws IOException for unreadable, non-regular, AND empty files.
+      // If the path is a readable regular file the only reason for the exception is that it is
+      // empty, which means no credential was supplied - return null in that case.
+      final Path path = userFile.toAbsolutePath().normalize();
+      if (Files.isRegularFile(path) && Files.isReadable(path)) {
+        return null;
+      }
+      throw new IORuntimeException("User could not be read from file <%s>".formatted(userFile), e);
     }
   }
 

schemacrawler-commandline/src/main/java/schemacrawler/tools/commandline/utility/GenerateCliSupport.java

@@ -9,7 +9,6 @@
 package schemacrawler.tools.commandline.utility;
 
 import java.io.IOException;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Arrays;
@@ -60,7 +59,7 @@ public void run() {
       boolean isErrored = false;
 
       outputDir = createOutputDirectory();
-      final Path completionScript = createCompletionScriptPath();
+      final Path completionScript = outputDir.resolve(completionScriptFilename).toAbsolutePath();
 
       if (generateAsciiDoc()) {
         isErrored = true;
@@ -83,34 +82,6 @@ protected Path createOutputDirectory() {
       return outputDir.toAbsolutePath();
     }
 
-    private Path createCompletionScriptPath() {
-      final Path outputDirPath = outputDir.toAbsolutePath().normalize();
-      final String filename =
-          completionScriptFilename == null ? "" : completionScriptFilename.trim();
-      final Path scriptFileName;
-      try {
-        scriptFileName = Path.of(filename);
-      } catch (final InvalidPathException e) {
-        throw new IllegalArgumentException(
-            "Completion script file name is invalid <%s>".formatted(completionScriptFilename), e);
-      }
-
-      if (filename.isEmpty()
-          || scriptFileName.isAbsolute()
-          || scriptFileName.getNameCount() != 1
-          || ".".equals(scriptFileName.toString())
-          || "..".equals(scriptFileName.toString())) {
-        throw new IllegalArgumentException(
-            "Completion script file name must be a simple file name");
-      }
-
-      final Path completionScript = outputDirPath.resolve(scriptFileName).normalize();
-      if (!completionScript.startsWith(outputDirPath)) {
-        throw new IllegalArgumentException("Completion script path resolves outside output directory");
-      }
-      return completionScript;
-    }
-
     private CommandLine createCommandLine(final Object commands) {
       final ShellState state = new ShellState();
       final StateFactory stateFactory = new StateFactory(state);