Code Monkey home page Code Monkey logo

lobjois_yann_3_chatop_012023's Introduction

ChaTop API


This project was generated with:

Spring Boot version 3.0.1.

OpenJDK version 19.0.1.

Spring Security version 6.0.0.


Start the project (with Spring Tool Suite 4 IDE)


Http-server (Node.JS static HTTP server to store images locally for creating and updating rentals with pictures):

Node.JS http-server on npm

Create a folder and note* the complete path. For example : C:\Users\user\Downloads\HttpServer

Inside this folder, install http-server globally: npm install --global http-server

Launch http-server: http-server ./

The path for the http-server (value in application.properties): http://127.0.0.1:8080/


Git clone:

git clone https://github.com/Lob2018/Lobjois_Yann_3_ChaTop_012023


Set the user's environment variables (batch file with command prompt)

Double-click on CHATOP_CREATE_ENVIRONMENT_VAR.bat, to set the variables* and note their values*

Those environment variables are needed to use this API

(double-click on CHATOP_DROP_ENVIRONMENT_VAR.bat if you want to remove them after)


MySQL version 8.0.31 (MySQL Community Server - GPL):

Port: 3306

Create the username and the password (*from noted values)

Create a new schema named: chatop

Give rights for this username on the chatop schema

Execute the queries from the script src/main/resources/data.sql for the chatop schema


Start the API with Spring Tool Suite 4:

Right-click on folder > Run as > Maven install (install Maven dependencies)

Boot dashboard > Select the project > Start the process (start the ChaTop API)


Front-end:

With Postman or with the Angular application


API Properties

Tomcat port: 3001

Maximum file and request size is 5MB

For the picture of the rental, only the name of the file is saved in the database.


Resources


MySQL

SQL script for creating the schema is available src/main/resources/data.sql


Postman collection

Import the collection src/main/resources/rental.postman_collection.json

Postman's documentation to import a collection:

https://learning.postman.com/docs/getting-started/importing-and-exporting-data/#importing-data-into-postman


Swagger

Swagger UI in HTML is available at http://localhost:3001/swagger-ui/index.html#/


User environment variables details


Variable for MySQL password: CHATOP_YL_API_MYSQL_PASSWORD

Variable for MySQL username: CHATOP_YL_API_MYSQL_USERNAME

Variable for the JWT issuer: CHATOP_YL_API_JWTISSUER

Variable for the JWT secret: CHATOP_YL_API_JWTSECRET

Variable for the http-server folder path: CHATOP_YL_LOCAL_PATH_FOLDER



Example of creating a user (after installation)


MySQL : Run MySQL

Spring Tool suite: Run ChaTop API

Postman: File import src/main/resources/rental.postman_collection.json

Postman: auth > register > Send

Postman: The token is in the Body of the response with HTTP code 200

MySQL : The user is created

lobjois_yann_3_chatop_012023's People

Contributors

lob2018 avatar mend-bolt-for-github[bot] avatar

Watchers

avatar

lobjois_yann_3_chatop_012023's Issues

jjwt-0.9.1.jar: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jjwt-0.9.1.jar

Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/

Library home page: https://github.com/jwtk/jjwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/jsonwebtoken/jjwt/0.9.1/jjwt-0.9.1.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jjwt version) Remediation Possible**
CVE-2024-31033 High 7.5 jjwt-0.9.1.jar Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-31033

Vulnerable Library - jjwt-0.9.1.jar

Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/

Library home page: https://github.com/jwtk/jjwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/jsonwebtoken/jjwt/0.9.1/jjwt-0.9.1.jar

Dependency Hierarchy:

  • ❌ jjwt-0.9.1.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.

Publish Date: 2024-04-01

URL: CVE-2024-31033

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

spring-boot-starter-security-3.0.1.jar: 6 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - spring-boot-starter-security-3.0.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-boot-starter-security version) Remediation Possible**
CVE-2023-34034 Critical 9.8 spring-security-config-6.0.1.jar Transitive N/A* ❌
CVE-2022-1471 Critical 9.8 snakeyaml-1.33.jar Transitive N/A* ❌
CVE-2023-20863 Medium 6.5 spring-expression-6.0.3.jar Transitive N/A* ❌
CVE-2023-20861 Medium 6.5 spring-expression-6.0.3.jar Transitive N/A* ❌
CVE-2023-20862 Medium 6.3 spring-security-web-6.0.1.jar Transitive N/A* ❌
CVE-2023-34035 Medium 5.3 spring-security-config-6.0.1.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-34034

Vulnerable Library - spring-security-config-6.0.1.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.1/spring-security-config-6.0.1.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • ❌ spring-security-config-6.0.1.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.

Publish Date: 2023-07-19

URL: CVE-2023-34034

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34034

Release Date: 2023-07-19

Fix Resolution: org.springframework.security:spring-security-config:5.6.12,5.7.10,5.8.5,6.0.5,6.1.2

Step up your Open Source Security Game with Mend here

CVE-2022-1471

Vulnerable Library - snakeyaml-1.33.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • spring-boot-starter-3.0.1.jar
      • ❌ snakeyaml-1.33.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Publish Date: 2022-12-01

URL: CVE-2022-1471

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374

Release Date: 2022-12-01

Fix Resolution: org.yaml:snakeyaml:2.0

Step up your Open Source Security Game with Mend here

CVE-2023-20863

Vulnerable Library - spring-expression-6.0.3.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/6.0.3/spring-expression-6.0.3.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • spring-security-web-6.0.1.jar
      • ❌ spring-expression-6.0.3.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-04-13

URL: CVE-2023-20863

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20863

Release Date: 2023-04-13

Fix Resolution: org.springframework:spring-expression - 5.2.24.RELEASE,5.3.27,6.0.8

Step up your Open Source Security Game with Mend here

CVE-2023-20861

Vulnerable Library - spring-expression-6.0.3.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/6.0.3/spring-expression-6.0.3.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • spring-security-web-6.0.1.jar
      • ❌ spring-expression-6.0.3.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-03-23

URL: CVE-2023-20861

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20861

Release Date: 2023-03-23

Fix Resolution: org.springframework:spring-expression:x5.2.23.RELEASE,5.3.26,6.0.7

Step up your Open Source Security Game with Mend here

CVE-2023-20862

Vulnerable Library - spring-security-web-6.0.1.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/6.0.1/spring-security-web-6.0.1.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • ❌ spring-security-web-6.0.1.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Publish Date: 2023-04-19

URL: CVE-2023-20862

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20862

Release Date: 2023-04-19

Fix Resolution: org.springframework.security:spring-security-web:5.7.8,5.8.3,6.0.3

Step up your Open Source Security Game with Mend here

CVE-2023-34035

Vulnerable Library - spring-security-config-6.0.1.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/6.0.1/spring-security-config-6.0.1.jar

Dependency Hierarchy:

  • spring-boot-starter-security-3.0.1.jar (Root Library)
    • ❌ spring-security-config-6.0.1.jar (Vulnerable Library)

Found in HEAD commit: b8138bd35e40d1c3370e17466ad7f3d1c98da462

Found in base branch: main

Vulnerability Details

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

  • Spring MVC is on the classpath
  • Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
  • The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints

An application is not vulnerable if any of the following is true:

  • The application does not have Spring MVC on the classpath
  • The application secures no servlets other than Spring MVC’s DispatcherServlet
  • The application uses requestMatchers(String) only for Spring MVC endpoints

Publish Date: 2023-07-18

URL: CVE-2023-34035

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4vpr-xfrp-cj64

Release Date: 2023-07-18

Fix Resolution: org.springframework.security:spring-security-config:5.8.5,6.0.5,6.1.2

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.