Fix method name typos in CachedCipher, deprecate legacy methods, and add customizable file size limit to FileUtil

[marevol]

This pull request introduces important security and usability enhancements across several utility classes, as well as dependency and bug fixes. The most significant changes are the addition of path traversal protections in FileUtil, secure deserialization in SerializeUtil, improved documentation and configuration for cryptography in CachedCipher, and a bug fix in ArrayMap. It also updates the SLF4J dependency to the latest version.

Security Improvements

• src/main/java/org/codelibs/core/io/FileUtil.java: Added isPathSafe(Path, Path) and isPathSafe(File, File) methods to validate file paths and prevent path traversal attacks. Documentation now strongly recommends validating untrusted paths. [1] [2]
• src/main/java/org/codelibs/core/io/SerializeUtil.java: Introduced default and customizable ObjectInputFilter for deserialization, restricting allowed classes to prevent deserialization attacks. Added helper methods for creating permissive or custom filters. [1] [2] [3]

Usability and Documentation

• src/main/java/org/codelibs/core/crypto/CachedCipher.java: Enhanced documentation with security guidance and usage examples. Changed default transformation from RSA to Blowfish for consistency, and improved charset handling for key generation. [1] [2] [3] [4] [5] [6]
• src/main/java/org/codelibs/core/io/FileUtil.java: Added buffer size limits and documentation to file reading methods to prevent OutOfMemoryError and encourage use of streaming APIs for large files. [1] [2]

Bug Fixes

• src/main/java/org/codelibs/core/collection/ArrayMap.java: Fixed a bug in setValue() to correctly return the previous value instead of the new value.

Dependency Updates

• pom.xml: Updated the SLF4J dependency from version 1.7.26 to 2.0.16 for improved logging and compatibility.

[Copilot]

Pull Request Overview

This PR enhances security, improves code maintainability, and updates dependencies. Key improvements include protection against path traversal and deserialization attacks, migration to standard Java APIs for better compatibility, and a critical bug fix in ArrayMap.

Key Changes:

• Added security protections against path traversal attacks in FileUtil and deserialization attacks in SerializeUtil
• Migrated Base64Util to use java.util.Base64 and removed unsafe JDK internals from StringUtil
• Fixed bug in ArrayMap.setValue() that returned incorrect value
• Updated SLF4J dependency from 1.7.26 to 2.0.16

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/main/java/org/codelibs/core/io/FileUtil.java	Added path traversal validation methods and file size limits with documentation
src/main/java/org/codelibs/core/io/SerializeUtil.java	Implemented ObjectInputFilter for secure deserialization with customizable filters
src/main/java/org/codelibs/core/crypto/CachedCipher.java	Enhanced documentation, changed default transformation, improved charset handling
src/main/java/org/codelibs/core/misc/Base64Util.java	Replaced custom implementation with standard java.util.Base64
src/main/java/org/codelibs/core/lang/StringUtil.java	Removed unsafe JDK internals usage in newStringUnsafe method
src/main/java/org/codelibs/core/collection/ArrayMap.java	Fixed setValue to return previous value instead of new value
src/main/java/org/codelibs/core/collection/LruHashMap.java	Added thread-safety documentation
src/test/java/org/codelibs/core/io/FileUtilTest.java	Added comprehensive tests for path validation and file size limits
src/test/java/org/codelibs/core/io/SerializeUtilTest.java	Added tests for deserialization filters and edge cases
src/test/java/org/codelibs/core/misc/Base64UtilTest.java	Added tests for edge cases and backward compatibility
pom.xml	Updated SLF4J dependency to version 2.0.16

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] Consider using enhanced for-loop variable naming. The variable 'pattern' could be named 'allowedPattern' to better indicate it's an allowed pattern from the DEFAULT_ALLOWED_PATTERNS set.

Suggested change

	for (String pattern : DEFAULT_ALLOWED_PATTERNS) {
	if (pattern.endsWith("*")) {
	String prefix = pattern.substring(0, pattern.length() - 1);
	if (className.startsWith(prefix)) {
	return ObjectInputFilter.Status.ALLOWED;
	}
	} else if (className.equals(pattern)) {
	for (String allowedPattern : DEFAULT_ALLOWED_PATTERNS) {
	if (allowedPattern.endsWith("*")) {
	String prefix = allowedPattern.substring(0, allowedPattern.length() - 1);
	if (className.startsWith(prefix)) {
	return ObjectInputFilter.Status.ALLOWED;
	}
	} else if (className.equals(allowedPattern)) {

[Copilot]

[nitpick] Consider using enhanced for-loop variable naming. The variable 'pattern' could be named 'allowedPattern' to better indicate it's from the allowedPatterns parameter.

Suggested change

	for (String pattern : allowedPatterns) {
	if (pattern.endsWith("*")) {
	String prefix = pattern.substring(0, pattern.length() - 1);
	if (className.startsWith(prefix)) {
	return ObjectInputFilter.Status.ALLOWED;
	}
	} else if (className.equals(pattern)) {
	for (String allowedPattern : allowedPatterns) {
	if (allowedPattern.endsWith("*")) {
	String prefix = allowedPattern.substring(0, allowedPattern.length() - 1);
	if (className.startsWith(prefix)) {
	return ObjectInputFilter.Status.ALLOWED;
	}
	} else if (className.equals(allowedPattern)) {

[Copilot]

Corrected spelling of 'encrypto' to 'encrypt'

Suggested change

	* String encrypted = cipher.encryptoText("Hello World");
	* String encrypted = cipher.encryptText("Hello World");

[Copilot]

Corrected spelling of 'decrypto' to 'decrypt'

Suggested change

	* String decrypted = cipher.decryptoText(encrypted);
	* String decrypted = cipher.decryptText(encrypted);