security: clear CodeQL findings (gmtime thread-safety + path-injection hardening)

Clears the 8 real CodeQL security alerts on frstrtr/c2pool. Triaged +
independently re-reviewed: 1 CRITICAL is a genuine fix, 2 HIGH get
defense-in-depth, 5 HIGH are getenv-rooted false positives (dismissed
separately with justification).

- #490 CRITICAL cpp/potentially-dangerous-function (src/core/log.cpp:163):
  std::gmtime returns a pointer into a shared static tm and is not
  reentrant. Replace with gmtime_r (POSIX) / gmtime_s (MSVC) into a local
  tm. Only gmtime/localtime call in src/.

- #502/#503 HIGH cpp/path-injection (coin_peer_manager.hpp db_path()):
  m_symbol is a hardcoded ticker literal at every production ctor site
  (traced through all callers; no network->filename path exists), but
  add an alphanumeric-only guard so a future caller cannot inject a path
  component. Legitimate tickers (LTC/DOGE/DGB/DASH/BTC/NMC/...) are all
  alnum -> no on-disk filename change.

- Rider: core::filesystem::config_path() dereferenced getenv() without a
  null check -> std::filesystem::path(nullptr) is UB if HOME/APPDATA is
  unset. Fall back to '.'.

The other 5 path-injection alerts (#507 node.cpp:2199, #506/#505/#504
payout_manager.cpp:224/261/284, #501 auto_ratchet.hpp:309) all build a
path from config_path() (getenv HOME/APPDATA) + a hardcoded basename,
never from network/peer/miner input -> dismissed as false positive.

Author: integrator

src/c2pool/merged/coin_peer_manager.hpp

@@ -17,6 +17,7 @@
 #include <cmath>
 #include <random>
 #include <algorithm>
+#include <cctype>
 #include <array>
 #include <sstream>
 
@@ -698,7 +699,20 @@ class CoinPeerManager
         else
             dir = m_data_dir;
         std::filesystem::create_directories(dir);
-        return (dir / ("peers_" + m_symbol + ".json")).string();
+        // Defense-in-depth (CodeQL cpp/path-injection): m_symbol is a hardcoded
+        // ticker literal at every production ctor site, but never let it become a
+        // path component. Reject anything non-alphanumeric so no '/','\\','.' or
+        // NUL can survive into the filename.
+        std::string sym = m_symbol;
+        const bool clean = !sym.empty() && sym.size() <= 16 &&
+            std::all_of(sym.begin(), sym.end(),
+                        [](unsigned char c) { return std::isalnum(c) != 0; });
+        if (!clean) {
+            LOG_WARNING << "[PeerManager] non-alphanumeric coin symbol '"
+                        << m_symbol << "' -> using peers_unknown.json";
+            sym = "unknown";
+        }
+        return (dir / ("peers_" + sym + ".json")).string();
     }
 
     void save_peers()

src/core/filesystem.hpp

@@ -2,6 +2,7 @@
 
 #include <string>
 #include <filesystem>
+#include <cstdlib>
 
 namespace core
 {
@@ -11,10 +12,15 @@ namespace filesystem
 
 inline std::filesystem::path config_path()
 {
+    // getenv may return nullptr if the var is unset; std::filesystem::path(nullptr)
+    // is UB. Fall back to the current directory so an unset HOME/APPDATA degrades
+    // gracefully instead of crashing.
     #ifdef _WIN32
-        return std::filesystem::path(std::getenv("APPDATA")) / "c2pool";
+        const char* base = std::getenv("APPDATA");
+        return std::filesystem::path(base ? base : ".") / "c2pool";
     #else  // Linux + macOS
-        return std::filesystem::path(std::getenv("HOME")) / ".c2pool";
+        const char* base = std::getenv("HOME");
+        return std::filesystem::path(base ? base : ".") / ".c2pool";
     #endif
 }
 

src/core/log.cpp

@@ -160,7 +160,16 @@ void Logger::init(const std::string& log_file_name, int rotation_size_mb, int ma
         if (!fec && sz > static_cast<uintmax_t>(rotation_size_mb) * 1024 * 1024) {
             std::time_t t = std::time(nullptr);
             char ts[32];
-            std::strftime(ts, sizeof(ts), "%Y%m%d-%H%M%S", std::gmtime(&t));
+            // Thread-safe gmtime: std::gmtime returns a pointer into a shared
+            // static tm and is not reentrant (CodeQL cpp/potentially-dangerous-
+            // function). Use the reentrant per-platform variant into a local tm.
+            std::tm tmv{};
+#ifdef _WIN32
+            gmtime_s(&tmv, &t);   // MSVC secure-CRT: (tm*, time_t*)
+#else
+            gmtime_r(&t, &tmv);   // POSIX GCC/Clang: (time_t*, tm*)
+#endif
+            std::strftime(ts, sizeof(ts), "%Y%m%d-%H%M%S", &tmv);
             std::filesystem::path rotated =
                 rotated_dir / (debug_log.filename().string() + std::string(".") + ts);
             std::filesystem::rename(debug_log, rotated, fec);