fix: path validation for DotExporter/AnnotationManager + remove dead asCollection

Gvisual/src/gvisual/DotExporter.java

@@ -118,8 +118,10 @@ public void setTypeColor(String edgeType, String hexColor) {
      *
      * @param outputFile the file to write to
      * @throws IOException if writing fails
+     * @throws SecurityException if the path escapes allowed directories (CWE-22)
      */
     public void export(File outputFile) throws IOException {
+        ExportUtils.validateOutputPath(outputFile);
         try (Writer writer = new OutputStreamWriter(
                 new FileOutputStream(outputFile), StandardCharsets.UTF_8)) {
             writer.write(exportToString());

Gvisual/src/gvisual/GraphAnnotationManager.java

@@ -495,7 +495,9 @@ else if (line.startsWith("\"tags\"")) {
      * Export annotations to a file.
      */
     public void exportToFile(String filePath) throws IOException {
-        try (Writer w = new FileWriter(filePath)) {
+        java.io.File file = new java.io.File(filePath);
+        ExportUtils.validateOutputPath(file);
+        try (Writer w = new FileWriter(file)) {
             w.write(exportToJson());
         }
     }
@@ -504,8 +506,10 @@ public void exportToFile(String filePath) throws IOException {
      * Import annotations from a file.
      */
     public int importFromFile(String filePath) throws IOException {
+        java.io.File file = new java.io.File(filePath);
+        ExportUtils.validateOutputPath(file);
         StringBuilder sb = new StringBuilder();
-        try (BufferedReader r = new BufferedReader(new FileReader(filePath))) {
+        try (BufferedReader r = new BufferedReader(new FileReader(file))) {
             String line;
             while ((line = r.readLine()) != null) {
                 sb.append(line).append("\n");

Gvisual/src/gvisual/IndependentSetAnalyzer.java

@@ -104,7 +104,7 @@ public boolean isMaximalIndependentSet(Set<String> vertices) {
      */
     public Set<String> greedyIndependentSet() {
         Set<String> result = new LinkedHashSet<>();
-        Set<String> remaining = new HashSet<>(asCollection(graph.getVertices()));
+        Set<String> remaining = new HashSet<>(graph.getVertices());
         Map<String, Set<String>> adjMap = GraphUtils.buildAdjacencyMap(graph, remaining);
 
         while (!remaining.isEmpty()) {
@@ -141,7 +141,7 @@ public Set<String> greedyIndependentSet() {
      */
     public Set<String> greedyMaxDegreeIndependentSet() {
         Set<String> result = new LinkedHashSet<>();
-        Set<String> remaining = new HashSet<>(asCollection(graph.getVertices()));
+        Set<String> remaining = new HashSet<>(graph.getVertices());
         Map<String, Set<String>> adjMap = GraphUtils.buildAdjacencyMap(graph, remaining);
 
         while (!remaining.isEmpty()) {
@@ -168,7 +168,7 @@ public Set<String> greedyMaxDegreeIndependentSet() {
         }
 
         // Better implementation: standard vertex removal approach
-        remaining = new HashSet<>(asCollection(graph.getVertices()));
+        remaining = new HashSet<>(graph.getVertices());
         while (!remaining.isEmpty()) {
             // Find max-degree vertex in remaining
             String maxV = null;
@@ -218,7 +218,7 @@ public Set<String> exactMaximumIndependentSet(int maxVertices) {
         }
         if (n == 0) return Collections.emptySet();
 
-        List<String> vertices = new ArrayList<>(asCollection(graph.getVertices()));
+        List<String> vertices = new ArrayList<>(graph.getVertices());
         Collections.sort(vertices);
         Map<String, Set<String>> adjMap = GraphUtils.buildAdjacencyMap(graph, new HashSet<>(vertices));
 
@@ -286,7 +286,7 @@ public List<Set<String>> allMaximalIndependentSets() {
      * @return list of maximal independent sets
      */
     public List<Set<String>> allMaximalIndependentSets(int maxCount) {
-        List<String> vertices = new ArrayList<>(asCollection(graph.getVertices()));
+        List<String> vertices = new ArrayList<>(graph.getVertices());
         Collections.sort(vertices);
         Map<String, Set<String>> adjMap = GraphUtils.buildAdjacencyMap(graph, new HashSet<>(vertices));
 
@@ -387,7 +387,7 @@ public KernelResult(Set<String> forced, Set<String> kernel,
      */
     public KernelResult kernelReduction() {
         Set<String> forced = new LinkedHashSet<>();
-        Set<String> remaining = new LinkedHashSet<>(asCollection(graph.getVertices()));
+        Set<String> remaining = new LinkedHashSet<>(graph.getVertices());
         Map<String, Set<String>> adj = GraphUtils.buildAdjacencyMap(graph, remaining);
         List<String> log = new ArrayList<>();
         int rules = 0;
@@ -570,7 +570,7 @@ public int[] independencePolynomial() {
                 "Independence polynomial computation limited to 20 vertices, graph has " + n);
         }
 
-        List<String> vertices = new ArrayList<>(asCollection(graph.getVertices()));
+        List<String> vertices = new ArrayList<>(graph.getVertices());
         Collections.sort(vertices);
         Map<String, Set<String>> adj = GraphUtils.buildAdjacencyMap(graph, new HashSet<>(vertices));
 
@@ -617,7 +617,7 @@ public Set<String> maximumCliqueViaComplement() {
 
     private Graph<String, edge> buildComplement() {
         Graph<String, edge> comp = new UndirectedSparseGraph<>();
-        List<String> vertices = new ArrayList<>(asCollection(graph.getVertices()));
+        List<String> vertices = new ArrayList<>(graph.getVertices());
         for (String v : vertices) comp.addVertex(v);
         int edgeId = 0;
         for (int i = 0; i < vertices.size(); i++) {
@@ -723,7 +723,7 @@ public IndependentSetReport fullReport() {
 
 
     @SuppressWarnings("unchecked")
-    private Collection<String> asCollection(Collection<String> c) {
+    private Collection<String> Collection<String> c {
         return c;
     }
 }