fix: validate FDP-supplied ids before building request URIs (SSRF)

[qplevier]

Summary

• Snyk Code flagged a CWE-918 SSRF issue: task.uuid, task.UUID, and resourceId — values returned by the remote FDP server — were concatenated directly into outgoing request URIs in FdpClient.
• Adds a validatedId helper that requires these ids to be well-formed UUIDs before use, so a malicious/compromised FDP response can't inject extra path segments or redirect requests elsewhere.
• Applied at all four affected call sites: updateSchema, releaseSchema, fetchResource, updateResource.

🤖 Generated with Claude Code

[kburger]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR hardens FdpClient against CWE-918-style URI construction issues by validating FDP-supplied identifiers before embedding them into outgoing request URIs.

Changes:

• Added a validatedId(String) helper that requires well-formed UUIDs before use in request paths.
• Applied UUID validation at the affected URI construction sites (updateSchema, releaseSchema, fetchResource, updateResource).

Suppressed comments (1)

src/main/java/nl/healthri/fdp/uploadschema/integrations/FdpClient.java:284

• fetchResource() logs the FDP-supplied resourceId before it is validated. If the id is malicious/compromised, this can still cause log injection (newlines/control chars) even though URI building now validates the id. Log the validated id instead (or avoid logging untrusted ids).

            URI uri = new URI(this.hostname + "/resource-definitions/" + validatedId(resourceId));

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/main/java/nl/healthri/fdp/uploadschema/integrations/FdpClient.java:68

• Catching NullPointerException here is avoidable and makes the intent less clear. A simple explicit null check keeps the exception handling focused on UUID parsing failures and avoids relying on NPE control flow.

    private static String validatedId(String id) {
        try {
            return UUID.fromString(id).toString();
        } catch (IllegalArgumentException | NullPointerException e) {
            String safeId = id == null ? "null" : id.replaceAll("[\\r\\n\\t]", "_");