ci(security): generate cyclonedx sbom, add sbom upload to ci and update stride security model

modules/cybercore-app/src/main/java/br/com/cybercore/signer/app/CyberCoreSignerApplication.java

@@ -41,7 +41,7 @@ public class CyberCoreSignerApplication {
                     buildFlavor = flavor.trim().toLowerCase();
                 }
             }
-        } catch (Exception ignored) {}
+        } catch (java.io.IOException ignored) {}
     }
 
     public static String getBuildFlavor() {
@@ -189,7 +189,8 @@ public class CyberCoreSignerApplication {
                     try {
                         configuredPort = Integer.parseInt(args[++i].trim());
                     } catch (NumberFormatException e) {
-                        logger.warn("Porta inválida especificada em --port: '{}'. Usando porta padrão {}.", args[i], CcspServer.DEFAULT_PORT);
+                        String sanitized = args[i].replaceAll("[\r\n]", "");
+                        logger.warn("Porta inválida especificada em --port: '{}'. Usando porta padrão {}.", sanitized, CcspServer.DEFAULT_PORT);
                     }
                 }
             }

modules/cybercore-core/src/main/java/br/com/cybercore/signer/core/security/ApplicationRegistry.java

@@ -54,10 +54,11 @@ public final class ApplicationRegistry {
     }
 
     private static Path resolveKeyPathForStorage(Path storagePath) {
-        if (storagePath == null || storagePath.getParent() == null) {
+        if (storagePath == null) {
             return null;
         }
-        return storagePath.getParent().resolve(".vault_key");
+        Path parent = storagePath.getParent();
+        return parent != null ? parent.resolve(".vault_key") : null;
     }
 
     private static Path resolveDefaultStoragePath() {

modules/cybercore-core/src/main/java/br/com/cybercore/signer/core/security/HmacIntegrityManager.java

@@ -26,6 +26,7 @@ import java.util.Set;
 public class HmacIntegrityManager {
 
     private static final Logger logger = LoggerFactory.getLogger(HmacIntegrityManager.class);
+    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
     private static final String HMAC_ALGORITHM = "HmacSHA256";
     private static final int KEY_SIZE_BYTES = 32;
     private static final String DEFAULT_KEY_FILE = ".vault_key";
@@ -50,7 +51,7 @@ public class HmacIntegrityManager {
     private synchronized void initSecretKey() {
         if (keyPath == null) {
             byte[] ephemeralKey = new byte[KEY_SIZE_BYTES];
-            new SecureRandom().nextBytes(ephemeralKey);
+            SECURE_RANDOM.nextBytes(ephemeralKey);
             this.secretKey = ephemeralKey;
             return;
         }
@@ -67,7 +68,7 @@ public class HmacIntegrityManager {
 
             // Gera nova chave criptográfica forte
             byte[] newKey = new byte[KEY_SIZE_BYTES];
-            new SecureRandom().nextBytes(newKey);
+            SECURE_RANDOM.nextBytes(newKey);
             this.secretKey = newKey;
 
             Path parent = keyPath.getParent();
@@ -82,7 +83,7 @@ public class HmacIntegrityManager {
         } catch (Exception e) {
             logger.warn("Falha ao persistir chave em {}. Usando chave em memória: {}", keyPath, e.getMessage());
             byte[] fallbackKey = new byte[KEY_SIZE_BYTES];
-            new SecureRandom().nextBytes(fallbackKey);
+            SECURE_RANDOM.nextBytes(fallbackKey);
             this.secretKey = fallbackKey;
         }
     }
@@ -129,11 +130,14 @@ public class HmacIntegrityManager {
 
         File file = path.toFile();
         // Proteção padrão Java SE (funciona em Windows e Unix)
-        file.setReadable(false, false);
-        file.setReadable(true, true);
-        file.setWritable(false, false);
-        file.setWritable(true, true);
-        file.setExecutable(false, false);
+        boolean ok = file.setReadable(false, false);
+        ok = file.setReadable(true, true) && ok;
+        ok = file.setWritable(false, false) && ok;
+        ok = file.setWritable(true, true) && ok;
+        ok = file.setExecutable(false, false) && ok;
+        if (!ok) {
+            logger.debug("Não foi possível ajustar todos os atributos em {}", path);
+        }
 
         // Permissões POSIX estritas (Linux / macOS)
         if (FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) {

modules/cybercore-ui/src/main/java/br/com/cybercore/signer/ui/CyberCoreDesktopApplication.java

@@ -476,11 +476,15 @@ public class CyberCoreDesktopApplication extends Application {
                         if (docSize == null && request.pdf() != null) {
                             try {
                                 docSize = (long) Base64.getDecoder().decode(request.pdf()).length;
-                            } catch (Exception ignored) {}
+                            } catch (IllegalArgumentException e) {
+                                logger.debug("Não foi possível decodificar base64 do PDF: {}", e.getMessage());
+                            }
                         } else if (docSize == null && request.xmlBase64() != null) {
                             try {
                                 docSize = (long) Base64.getDecoder().decode(request.xmlBase64()).length;
-                            } catch (Exception ignored) {}
+                            } catch (IllegalArgumentException e) {
+                                logger.debug("Não foi possível decodificar base64 do XML: {}", e.getMessage());
+                            }
                         }
 
                         String requestOrigin = request.origin();