Security issues

[amir-zeldes]

Hi @thomaskrause - we are getting some potential security issues flagged by an automatic code inspection:

1. com.lgtm/java-queries:java/stack-trace-exposure: com.lgtm/java-queries:java/stack-trace-exposure (src/main/java/org/corpus_tools/annis/gui/servlets/CitationRedirectionServlet.java#L51)

2. com.lgtm/java-queries:java/spring-disabled-csrf-protection: com.lgtm/java-queries:java/spring-disabled-csrf-protection (src/main/java/org/corpus_tools/annis/gui/security/SecurityConfiguration.java#L90)

It would be really great if these could be patched quickly!

[thomaskrause]

This will be addressed in a bugfix 4.9.1 release later this day by #783

1. com.lgtm/java-queries:java/stack-trace-exposure: com.lgtm/java-queries:java/stack-trace-exposure ([src/main/java/org/corpus_tools/annis/gui/servlets/CitationRedirectionServlet.java#L51](https://github.com/korpling/ANNIS/blob/main/src/main/java/org/corpus_tools/annis/gui/servlets/CitationRedirectionServlet.java#L51))

The fix for this potential problem (part of the pull request #783) is not to include any information from the exception at all, even if in the original only the message of the exception (and not as claimed the whole stacktrace) is exposed.

2. com.lgtm/java-queries:java/spring-disabled-csrf-protection: com.lgtm/java-queries:java/spring-disabled-csrf-protection ([src/main/java/org/corpus_tools/annis/gui/security/SecurityConfiguration.java#L90](https://github.com/korpling/ANNIS/blob/main/src/main/java/org/corpus_tools/annis/gui/security/SecurityConfiguration.java#L90))

The second issue is not an issue after reviewing this again. But the explanation in the comment why this is needed/ok was wrong.
I updated the comment for future reviewers to explain more what is going on and why this code is safe.
This is the updated comment:

        // Not using Spring CSRF protection here because Vaadin also has a
        // Cross-site request forgery protection running.
        // Spring will try to enforce an additional layer
        // on the filtered resources, which conflicts with
        // the Vaadin CSRF protection and makes the frontend
        // unusable. Disabling Spring CSRF is therefore
        // safe, as long as Vaadin CSRF protection is
        // activated (which it is per default).
        // https://vaadin.com/blog/filter-based-spring-security-in-vaadin-applications
       .and().csrf().disable();

[thomaskrause]

This is addressed in the bugfix release 4.9.1