fix: resolve approved issues - batch verified by adversarial consensus

Issues resolved:
- #277: Fix ClusteredApplicationManager anonymous listener memory leak
- #278: Add HTTP method validation to NettyApiServer routes
- #280: Configure EtcdServiceRegistry ObjectMapper for security
- #281: Fix EtcdServiceRegistry.registerService() silent failure
- #285: Add shutdown timeout to NettyApiServer.stop()
- #286: Fix EtcdServiceRegistry.renewLeases() concurrent modification
- #385: Add CASE_INSENSITIVE flag to CredentialMasker BASIC_AUTH_PATTERN
- #386: Fix CredentialMasker ENV_VAR_PATTERN no-op
- #387: Preserve original format in CredentialMasker replacements
- #388: Replace System.exit calls with proper exception handling
- #389: Shut down ApplicationManager.listenerExecutor on shutdown
- #390: Add per-application lock to ApplicationManager.forceKill()
- #391: Fix missing ExecutorService shutdown in ApplicationManager
- #393: Fix IndexOutOfBoundsException in RedisClusterManager JSON parsing
- #394: Add null safety to ContainerLauncher.readContainerId()
- #396: Sanitize container name/properties to prevent command injection
- #399: Make ApplicationResourceMonitor.history thread-safe
- #400: Fix TOCTOU race in ClusteredApplicationManager deployment
- #401: Replace non-thread-safe HashMap in DependencyResolver
- #403: Fix ApplicationReloader versionHistory thread safety
- #404: Fix ClassLoaderCleanupUtil ThreadLocal filtering
- #407: Make HealthChecker.consecutiveFailures atomic
- #412: Fix string index out of bounds in env var resolution

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Flossy

platform-api/src/main/java/org/flossware/platform/api/ApplicationDescriptor.java

@@ -214,7 +214,9 @@ public Optional<String> resolveProperty(String propertyKey) {
     }
 
     // Check if this looks like a secret reference: ${VARNAME}
-    if (value.startsWith("${") && value.endsWith("}")) {
+    // Minimum length of 4 ensures a non-empty variable name (e.g., "${X}")
+    // and prevents StringIndexOutOfBoundsException from malformed patterns
+    if (value.length() > 3 && value.startsWith("${") && value.endsWith("}")) {
       String varName = value.substring(2, value.length() - 1);
       String resolved = System.getenv(varName);
       return Optional.ofNullable(resolved);

platform-api/src/main/java/org/flossware/platform/api/CredentialMasker.java

@@ -45,16 +45,19 @@ public final class CredentialMasker {
   private static final String MASKED_VALUE = "***MASKED***";
 
   // Regex patterns for common credential patterns
+  // Group 1 captures the prefix (key + delimiter) to preserve original format in replacements
   private static final Pattern PASSWORD_PATTERN =
-      Pattern.compile("password[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+      Pattern.compile(
+          "(password[\"']?\\s*[:=]\\s*[\"']?)([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
   private static final Pattern TOKEN_PATTERN =
-      Pattern.compile("token[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+      Pattern.compile("(token[\"']?\\s*[:=]\\s*[\"']?)([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
   private static final Pattern API_KEY_PATTERN =
       Pattern.compile(
-          "api[_\\s-]?key[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+          "(api[_\\s-]?key[\"']?\\s*[:=]\\s*[\"']?)([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
   private static final Pattern BEARER_PATTERN =
       Pattern.compile("Bearer\\s+([^\\s]+)", Pattern.CASE_INSENSITIVE);
-  private static final Pattern BASIC_AUTH_PATTERN = Pattern.compile("Basic\\s+([^\\s]+)");
+  private static final Pattern BASIC_AUTH_PATTERN =
+      Pattern.compile("Basic\\s+([^\\s]+)", Pattern.CASE_INSENSITIVE);
   private static final Pattern ENV_VAR_PATTERN = Pattern.compile("\\$\\{([A-Z0-9_]+)\\}");
 
   private CredentialMasker() {
@@ -74,23 +77,23 @@ public static String mask(String message) {
 
     String masked = message;
 
-    // Mask password values
-    masked = PASSWORD_PATTERN.matcher(masked).replaceAll("password=" + MASKED_VALUE);
+    // Mask password values (preserve original prefix format via $1 backreference)
+    masked = PASSWORD_PATTERN.matcher(masked).replaceAll("$1" + MASKED_VALUE);
 
-    // Mask token values
-    masked = TOKEN_PATTERN.matcher(masked).replaceAll("token=" + MASKED_VALUE);
+    // Mask token values (preserve original prefix format via $1 backreference)
+    masked = TOKEN_PATTERN.matcher(masked).replaceAll("$1" + MASKED_VALUE);
 
-    // Mask API key values
-    masked = API_KEY_PATTERN.matcher(masked).replaceAll("api_key=" + MASKED_VALUE);
+    // Mask API key values (preserve original prefix format via $1 backreference)
+    masked = API_KEY_PATTERN.matcher(masked).replaceAll("$1" + MASKED_VALUE);
 
     // Mask Bearer tokens
     masked = BEARER_PATTERN.matcher(masked).replaceAll("Bearer " + MASKED_VALUE);
 
     // Mask Basic auth
     masked = BASIC_AUTH_PATTERN.matcher(masked).replaceAll("Basic " + MASKED_VALUE);
 
-    // Mask environment variable references (but not the variable name)
-    masked = ENV_VAR_PATTERN.matcher(masked).replaceAll("\\$\\{$1\\}");
+    // Mask environment variable references (hide variable name)
+    masked = ENV_VAR_PATTERN.matcher(masked).replaceAll("\\${" + MASKED_VALUE + "}");
 
     return masked;
   }

platform-api/src/test/java/org/flossware/platform/api/ApplicationDescriptorTest.java

@@ -243,6 +243,36 @@ void testResolvePropertyNonExistent() {
     assertFalse(resolved.isPresent());
   }
 
+  @Test
+  void testResolvePropertyEmptyEnvVarPattern() {
+    // "${}" (length 3) should be treated as a plain value, not an env var reference
+    ApplicationDescriptor descriptor =
+        ApplicationDescriptor.builder()
+            .applicationId("edge-test")
+            .mainClass("com.example.App")
+            .property("empty.var", "${}")
+            .build();
+
+    Optional<String> resolved = descriptor.resolveProperty("empty.var");
+    assertTrue(resolved.isPresent());
+    assertEquals("${}", resolved.get());
+  }
+
+  @Test
+  void testResolvePropertyMalformedEnvVarPattern() {
+    // "${" (length 2) should be treated as a plain value
+    ApplicationDescriptor descriptor =
+        ApplicationDescriptor.builder()
+            .applicationId("edge-test2")
+            .mainClass("com.example.App")
+            .property("malformed.var", "${")
+            .build();
+
+    Optional<String> resolved = descriptor.resolveProperty("malformed.var");
+    assertTrue(resolved.isPresent());
+    assertEquals("${", resolved.get());
+  }
+
   @Test
   void testResolvePropertyWithEnvVarReference() {
     // Environment variable ${PATH} should be resolvable on any system

platform-api/src/test/java/org/flossware/platform/api/CredentialMaskerTest.java

@@ -82,13 +82,63 @@ void testMaskCaseInsensitive() {
     assertFalse(masked.contains("xyz789"));
   }
 
+  @Test
+  void testMaskEnvVarReference() {
+    String input = "Connection host: ${DB_HOST}";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("DB_HOST"), "Variable name should be masked");
+    assertTrue(masked.contains("${***MASKED***}"), "Should contain masked env var syntax");
+    assertEquals("Connection host: ${***MASKED***}", masked);
+  }
+
+  @Test
+  void testMaskMultipleEnvVarReferences() {
+    String input = "Using ${SECRET_KEY} and ${APP_CONFIG}";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("SECRET_KEY"));
+    assertFalse(masked.contains("APP_CONFIG"));
+    assertEquals("Using ${***MASKED***} and ${***MASKED***}", masked);
+  }
+
   @Test
   void testMaskNonCredentialContent() {
     String input = "Deploying application version 1.0.0";
     String masked = CredentialMasker.mask(input);
     assertEquals(input, masked);
   }
 
+  @Test
+  void testMaskPreservesJsonFormat() {
+    String input = "\"password\":\"secret123\"";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("secret123"));
+    assertTrue(masked.contains("\"password\":\"***MASKED***\""));
+  }
+
+  @Test
+  void testMaskPreservesColonDelimiter() {
+    String input = "password: secret123";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("secret123"));
+    assertTrue(masked.contains("password: ***MASKED***"));
+  }
+
+  @Test
+  void testMaskPreservesHyphenInApiKey() {
+    String input = "api-key=secret123";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("secret123"));
+    assertTrue(masked.contains("api-key=***MASKED***"));
+  }
+
+  @Test
+  void testMaskPreservesTokenColonFormat() {
+    String input = "\"token\":\"abc456\"";
+    String masked = CredentialMasker.mask(input);
+    assertFalse(masked.contains("abc456"));
+    assertTrue(masked.contains("\"token\":\"***MASKED***\""));
+  }
+
   @Test
   void testMaskNull() {
     assertNull(CredentialMasker.mask(null));

platform-classloader/src/main/java/org/flossware/platform/classloader/ClassLoaderCleanupUtil.java

@@ -173,7 +173,13 @@ private boolean clearThreadLocals(Thread thread) {
               Object value = valueField.get(entry);
 
               if (value != null && isLoadedByTargetClassLoader(value.getClass().getClassLoader())) {
-                table[i] = null; // Clear the entry
+                // Clear the value to release the application object reference
+                valueField.set(entry, null);
+                // Mark entry as stale by clearing the WeakReference key,
+                // so ThreadLocalMap.expungeStaleEntries() can properly reclaim the slot
+                if (entry instanceof WeakReference) {
+                  ((WeakReference<?>) entry).clear();
+                }
               }
             }
           }
@@ -201,7 +207,13 @@ private boolean clearThreadLocals(Thread thread) {
               Object value = valueField.get(entry);
 
               if (value != null && isLoadedByTargetClassLoader(value.getClass().getClassLoader())) {
-                inheritableTable[i] = null;
+                // Clear the value to release the application object reference
+                valueField.set(entry, null);
+                // Mark entry as stale by clearing the WeakReference key,
+                // so ThreadLocalMap.expungeStaleEntries() can properly reclaim the slot
+                if (entry instanceof WeakReference) {
+                  ((WeakReference<?>) entry).clear();
+                }
               }
             }
           }

platform-cluster-redis/src/main/java/org/flossware/platform/cluster/redis/RedisClusterManager.java

@@ -315,6 +315,9 @@ private String extractJsonString(String json, String key) {
     }
     start += pattern.length();
     int end = json.indexOf("\"", start);
+    if (end == -1) {
+      throw new IllegalArgumentException("Malformed JSON: missing closing quote for key " + key);
+    }
     return json.substring(start, end);
   }
 
@@ -336,6 +339,9 @@ private int extractJsonInt(String json, String key) {
     if (end == -1) {
       end = json.indexOf("}", start);
     }
+    if (end == -1) {
+      throw new IllegalArgumentException("Malformed JSON: missing delimiter after key " + key);
+    }
     return Integer.parseInt(json.substring(start, end).trim());
   }
 
@@ -357,6 +363,9 @@ private long extractJsonLong(String json, String key) {
     if (end == -1) {
       end = json.indexOf("}", start);
     }
+    if (end == -1) {
+      throw new IllegalArgumentException("Malformed JSON: missing delimiter after key " + key);
+    }
     return Long.parseLong(json.substring(start, end).trim());
   }
 

platform-cluster/src/main/java/org/flossware/platform/cluster/ApplicationScheduler.java

@@ -18,6 +18,7 @@
 package org.flossware.platform.cluster;
 
 import java.util.*;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 
 import org.flossware.platform.api.ClusterManager;
@@ -206,6 +207,39 @@ public boolean isAssignedToLocalNode(String applicationId) {
     return localNode != null && assignedNode.equals(localNode.getNodeId());
   }
 
+  /**
+   * Acquires a distributed lock on the assignment entry for the specified application. This prevents
+   * concurrent modification of the assignment while deployment is in progress, eliminating TOCTOU
+   * race conditions between assignment checks and deployment actions.
+   *
+   * <p>Uses Hazelcast IMap per-entry locking to ensure only one node can check and act on an
+   * assignment at a time.
+   *
+   * @param applicationId the application identifier
+   * @param timeout maximum time to wait for the lock
+   * @param unit time unit for the timeout
+   * @return true if the lock was acquired within the timeout
+   * @throws InterruptedException if the thread is interrupted while waiting
+   * @throws NullPointerException if applicationId is null
+   */
+  public boolean tryLockAssignment(String applicationId, long timeout, TimeUnit unit)
+      throws InterruptedException {
+    Objects.requireNonNull(applicationId, "applicationId cannot be null");
+    return assignmentMap.tryLock(applicationId, timeout, unit);
+  }
+
+  /**
+   * Releases the distributed lock on the assignment entry for the specified application. Must be
+   * called after {@link #tryLockAssignment} returns true, typically in a finally block.
+   *
+   * @param applicationId the application identifier
+   * @throws NullPointerException if applicationId is null
+   */
+  public void unlockAssignment(String applicationId) {
+    Objects.requireNonNull(applicationId, "applicationId cannot be null");
+    assignmentMap.unlock(applicationId);
+  }
+
   /**
    * Returns all application assignments in the cluster.
    *