Skip to content

Add files via upload #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SoftSec-Tech wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add files via upload #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
package com.softsafe.sast.platform.config.security;

import com.softsafe.sast.platform.config.RestAccessDeniedHandler;
import com.softsafe.sast.platform.config.RestAuthenticationEntryPoint;
import lombok.RequiredArgsConstructor;

@xytestapp xytestapp Bot Dec 12, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

在函数 process_test_data 中新增了 print(_add_new_func()) 语句，这会导致每次调用该函数时打印不必要的信息，影响性能和日志清晰度。

@xytestapp xytestapp Bot Dec 12, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

在函数 process_test_data 中新增了 print(_add_new_func()) 语句，这会导致每次调用该函数时打印不必要的信息，影响性能和日志清晰度。

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {
private final RestAuthenticationEntryPoint restAuthEntryPoint;
private final RestAccessDeniedHandler restAccessDeniedHandler;
private final OAuth2LoginSuccessHandler oauth2LoginSuccessHandler;

@Bean
@Order(2)
public SecurityFilterChain applicationSecurity(HttpSecurity http) throws Exception {

http.exceptionHandling(ex -> ex
.authenticationEntryPoint(restAuthEntryPoint)
.accessDeniedHandler(restAccessDeniedHandler)
)
.authorizeHttpRequests(authorize -> authorize
.requestMatchers(
"/", "/login", "/login.html",
"/error",
"/github/webhook",
"/api/sast/**",
"/favicon.ico", "/icons/**"
).permitAll()
.anyRequest().authenticated()
)
Comment on lines +29 to +38

@coderabbitai coderabbitai Bot Dec 12, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: Entire SAST API exposed without authentication.

The /api/sast/** pattern permits unauthenticated access to all SAST (Static Application Security Testing) endpoints. This is a significant security risk as SAST APIs typically handle sensitive security scan results and vulnerability data. Unless these endpoints are intentionally designed as public APIs, this configuration could lead to:

  • Unauthorized access to security scan results
  • Exposure of vulnerability information
  • Potential data leakage of sensitive security findings

Please verify whether this is intentional. If these endpoints should be protected, apply appropriate authentication requirements.

Run the following script to identify what endpoints exist under /api/sast/** and assess their sensitivity:

#!/bin/bash
# Description: Find all controllers/endpoints under /api/sast path to assess security implications

# Search for controller mappings under /api/sast
rg -n --type=java -C5 '@.*Mapping.*["\(]/api/sast|@RequestMapping.*sast'

# Search for RestController or Controller classes that might handle sast endpoints
rg -n --type=java -C3 'class.*SastController|class.*Sast.*Controller'
🤖 Prompt for AI Agents 
In SecurityConfig.java around lines 29 to 38 the pattern "/api/sast/**" is
currently listed in permitAll(), exposing all SAST endpoints; verify intent and
if they must be protected, remove "/api/sast/**" from the permitAll list and
require authentication instead (e.g., change to
.requestMatchers(...).permitAll() without the SAST pattern and add
.requestMatchers("/api/sast/**").authenticated() or
.hasAuthority("SAST_READ")/hasRole("ADMIN") as appropriate); run the provided
grep script to enumerate SAST controllers/endpoints, update/adjust
controller-level security annotations if needed, and add/adjust unit/integration
tests to assert the endpoints now require authentication and correct roles.

.oauth2Login(oauth2 -> oauth2
.successHandler(oauth2LoginSuccessHandler)
.failureUrl("/login?error")
)
.csrf(csrf -> csrf
.ignoringRequestMatchers("/github/webhook", "/api/sast/**")
);
Comment on lines +43 to +45

@coderabbitai coderabbitai Bot Dec 12, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Search for GitHub webhook signature verification logic
rg -n --type=java -C5 'X-Hub-Signature|webhook.*verify|signature.*github|hmac'

Repository: SoftSec-Tech/big_num_cal

Length of output: 50

🏁 Script executed:

# Find the webhook controller and handler
rg -n --type=java '@.*Mapping.*["\(].*webhook'

Repository: SoftSec-Tech/big_num_cal

Length of output: 50

🏁 Script executed:

# Examine SecurityConfig.java to see the full context around lines 43-45
fd SecurityConfig.java --type f

Repository: SoftSec-Tech/big_num_cal

Length of output: 87

🏁 Script executed:

# Search for authentication configuration to understand the permitAll setup
rg -n --type=java 'permitAll|csrf.*ignoringRequest' --max-count=20

Repository: SoftSec-Tech/big_num_cal

Length of output: 128

🏁 Script executed:

cat -n SecurityConfig.java

Repository: SoftSec-Tech/big_num_cal

Length of output: 2527

🏁 Script executed:

# Search more broadly for webhook-related code
rg -n --type=java 'webhook|github' -i

Repository: SoftSec-Tech/big_num_cal

Length of output: 249

🏁 Script executed:

# Search for any controller or handler classes
fd --type f --name '*Controller*' --o --name '*Handler*'

Repository: SoftSec-Tech/big_num_cal

Length of output: 318

🏁 Script executed:

# Search for any webhook-related implementations with different patterns
rg -n 'webhook|github' -i --type=java

Repository: SoftSec-Tech/big_num_cal

Length of output: 249

🏁 Script executed:

# Search for any controller classes
fd --type f -n '*Controller*'

Repository: SoftSec-Tech/big_num_cal

Length of output: 298

🏁 Script executed:

# Search for request mapping annotations that might handle webhooks
rg -n '@PostMapping|@RequestMapping|@GetMapping' --type=java -A2

Repository: SoftSec-Tech/big_num_cal

Length of output: 50

🏁 Script executed:

# Get overall project structure
git ls-files --type f | head -30

Repository: SoftSec-Tech/big_num_cal

Length of output: 2146

🏁 Script executed:

# Check if there are any TODOs or FIXMEs related to webhook
rg -n 'TODO|FIXME' --type=java -i

Repository: SoftSec-Tech/big_num_cal

Length of output: 50

🏁 Script executed:

# Search for test files that might reference webhook
fd --type f --extension java | xargs grep -l webhook 2>/dev/null || echo "No webhook references found"

Repository: SoftSec-Tech/big_num_cal

Length of output: 87

Evaluate CSRF protection configuration against intended endpoint behavior.

CSRF is disabled for /github/webhook and /api/sast/** at lines 44, which aligns with the permitAll() configuration at lines 29-36. Clarify whether this security posture is intentional:

  • For /github/webhook: Disabling CSRF is correct since external webhook services cannot handle CSRF tokens. Implement GitHub webhook signature verification (HMAC-SHA256 validation of X-Hub-Signature header) in the webhook handler.
  • For /api/sast/**: If these endpoints are intentionally public, CSRF exemption is acceptable. If they should be authenticated, remove them from permitAll() and reconsider CSRF protection based on your API design (stateless token-based APIs like JWT typically don't require CSRF; session-based APIs do).


return http.build();
}
}