fix: prevent path traversal in file download endpoint

[tranquac]

Summary

Prevent path traversal in the file download endpoint by validating the filename parameter.

Problem

The getResultFile endpoint constructs file paths by directly concatenating the user-supplied filename path variable:

@PathVariable("filename") String filename
// ...
String filePath = _resultPath + "/" + username + "/" + jobid + "/" + filename;
FileInputStream mFileInputStream = new FileInputStream(filePath);

An attacker can read arbitrary files using path traversal sequences:

• GET /results/jobid/../../etc/passwd → reads /etc/passwd
• Both the binary branch (PNG/PDF) and text branch are affected

Fix

Validate that filename doesn't contain path traversal sequences (.., /, \) before using it in file path construction:

if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
    throw new CelloNotFoundException("invalid filename");
}

Impact

• Type: Path Traversal / Arbitrary File Read (CWE-22)
• Affected endpoint: GET /results/{jobid}/{filename}
• Risk: Read any file accessible to the application process
• OWASP: A01:2021 — Broken Access Control