Fix critical dependency vulnerabilities and hardcoded credentials

[Copilot]

Endor-labs scan identified critical vulnerabilities in dependencies (Log4Shell, commons-text RCE, mysql auth bypass, c3p0 XXE) and hardcoded database credentials across 7 servlets.

Dependency Updates

• apache-commons-text: 1.9 → 1.10.0 (CVE-2022-42889 RCE)
• log4j-core: 2.3 → 2.23.1 (Log4Shell CVEs)
• mysql-connector-java: 5.1.42 → 8.0.33 (auth/privilege escalation)
• c3p0: 0.9.5.2 → 0.10.0 (XXE, billion laughs)
• mockito-core: 2.28.2 → 5.8.0
• error_prone_annotations: 2.7.1 → 2.24.1

Credential Management

Replaced hardcoded credentials with system property requirements:

// Before
String password = "Psqlpsmo@1";
conn = DriverManager.getConnection(dbURL, user, password);

// After
String password = System.getProperty("endor_db_password");
if (password == null || password.isEmpty()) {
    throw new ServletException("Database password must be provided via endor_db_password system property");
}
conn = DriverManager.getConnection(dbURL, user, password);

Updated files: NewSQLExitServlet, NewSQLExitServlet1, BooksServlet, RecordServlet, ExtraServlet, AsyncServlet, GetInputStreamInnerTest

Additional Changes

• Replaced HTTP URLs with HTTPS in HttpURLConnectionExample and GetInputStreamTest
• Added .gitignore for build artifacts

Original prompt

use endor-labs mcp server and the scan tool to fix all known vulnerabiltiies

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.