Platform links

[delchev]

Fixes: #5665 - Platform links backend support

To fix the problem, we should ensure that values derived from untrusted input are sanitized before being logged. The specific risky log is:

logger.info("Initializing the Local Registry file watcher on [{}], ignoring {}...", sourceDir, this.ignoredFolders);

where this.ignoredFolders originates from DirigibleConfig.REGISTRY_LOCAL_IGNORED_FOLDERS, which in turn can be set dynamically via Configuration.set(key, value) with user-provided data.

The best, least intrusive fix without changing behavior is to sanitize the ignored folder names when they are read, so that all uses (including logging) receive cleaned values. We can do this inside LocalRegistryWatcher.getIgnoredFolders() by stripping newline and carriage-return characters (and optionally other control characters) from each folder name before adding it to the set. This leaves the rest of the configuration mechanism unchanged and only normalizes this specific value, which is expected to be a list of folder names and should not legitimately contain such characters anyway.

Concretely, in components/core/core-registry/src/main/java/org/eclipse/dirigible/components/registry/watcher/LocalRegistryWatcher.java, we will change getIgnoredFolders() from:

String[] folders = ignoredFolders.split(",");
return Arrays.stream(folders)
             .map(String::trim)
             .collect(Collectors.toSet());

to something like:

String[] folders = ignoredFolders.split(",");
return Arrays.stream(folders)
             .map(String::trim)
             .map(LocalRegistryWatcher::sanitizeFolderName)
             .collect(Collectors.toSet());

and add a private static helper method sanitizeFolderName in the same class that removes \r and \n (and optionally any other control characters) from the string. No new external dependencies are needed; we can rely only on core String operations and character checks. The rest of the code remains unchanged, and logs will now include only sanitized folder names, eliminating the log injection vector.