/**
 * Utility class for handling {@link File}.
 * <p>
 * <strong>SECURITY NOTE:</strong> When accepting file paths from untrusted sources,
 * always validate them using {@link #isPathSafe(Path, Path)} to prevent path traversal attacks.
 * Methods that accept path strings do not perform automatic validation to maintain backward compatibility.
 * </p>
 *
 * @author higa
 */
public abstract class FileUtil {

    /**
     * Do not instantiate.

HTML meta tags. The default `htmlmetacontentescape=1` will cause URLs to be
escaped. Setting `htmlmetacontentescape=0` disables this behavior. To avoid
content injection attacks, this setting and default was backported to Go 1.25.8
and Go 1.26.1.

Go 1.27 changes the default for `tracebacklabels` (added in [Go 1.26](#go-126))
to `1`. This opt-out is expected to be kept indefinitely in case goroutine

     * This test ensures that the Kryo registration requirement is working correctly.
     * Unregistered classes should throw an exception to prevent potential RCE attacks.
     */
    @Test
    public void test_security_unregisteredClassRejected() {
        // File class is intentionally not registered to test security
        File unregisteredObject = new File("/tmp/test");

 */
package jcifs.util;

import java.util.regex.Pattern;

/**
 * Comprehensive input validation utility for SMB protocol implementation.
 * Provides validation methods to prevent buffer overflows, injection attacks,
 * and other security vulnerabilities.
 */
public final class InputValidator {

    private InputValidator() {
        // Utility class
    }

            final byte[] cmp = new byte[SIGNATURE_LENGTH];
            System.arraycopy(mac.doFinal(), 0, cmp, 0, SIGNATURE_LENGTH);

            // Use constant-time comparison to prevent timing attacks
            if (!MessageDigest.isEqual(sig, cmp)) {
                return false; // Signature verification failed
            }
            return true; // Signature verification succeeded
        } finally {

		header.Set("X-XSS-Protection", "1; mode=block")                                // Prevents against XSS attacks
		header.Set("X-Content-Type-Options", "nosniff")                                // Prevent mime-sniff
		header.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") // HSTS mitigates variants of MITM attacks

		// Previously, this value was set right before a response was sent to

By default, OkHttp trusts the certificate authorities of the host platform. This strategy maximizes connectivity, but it is subject to certificate authority attacks such as the [2011 DigiNotar attack](https://www.computerworld.com/article/2510951/cybercrime-hacking/hackers-spied-on-300-000-iranians-using-fake-google-certificate.html). It also assumes your HTTPS servers’ certificates are signed by a certificate authority.

import java.util.concurrent.atomic.AtomicLong;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import jcifs.smb.SmbException;

/**
 * Rate limiter for authentication attempts to prevent brute force attacks.
 *
 * Features:
 * - Per-account rate limiting
 * - Per-IP rate limiting
 * - Global rate limiting
 * - Exponential backoff for repeated failures
 * - Account lockout after threshold

        constantTimeCopy(output, message.length, authTag, 0, tagLength);

        return new EncryptionResult(ciphertext, authTag);
    }

    /**
     * Perform constant-time encryption to prevent timing attacks
     */
    private byte[] performConstantTimeEncryption(Cipher cipher, byte[] message) throws Exception {
        // Pad to fixed block size to prevent timing leaks
        int blockSize = cipher.getBlockSize();

import java.util.regex.Pattern;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import jcifs.smb.SmbException;

/**
 * Path validation utility to prevent directory traversal and other path-based attacks.
 *
 * Features:
 * - Directory traversal prevention
 * - Path normalization
 * - Blacklist/whitelist support
 * - UNC path validation
 * - Special character filtering
 * - Length validation
 */