GithubHelp home page GithubHelp logo

francesco146 / be-passportease Goto Github PK

View Code? Open in Web Editor NEW
3.0 2.0 0.0 5.78 MB

BackEnd of a computer system to manage the reservation service for passport issuance for a Police Headquarters, which has multiple locations in the territory.

Home Page: https://francesco146.github.io/BE-PassportEase/

License: MIT License

Java 99.70% Dockerfile 0.30%
univr

be-passportease's Issues

Refactor user service implementation

Refactor this:

// UserMutationServiceImpl.java
    public Availability createReservation(UUID availabilityId, User user)
            throws UserNotFoundException, AvailabilityNotFoundException, InvalidAvailabilityIDException {

        Optional<Availability> availabilityOptional = availabilityRepository.findById(availabilityId);

        if (!userRepository.existsById(user.getId())) throw new UserNotFoundException("User not found");
        if (availabilityOptional.isEmpty()) throw new AvailabilityNotFoundException("Availability not found");

        Availability availabilityRequested = availabilityOptional.get();

        if (availabilityRequested.getStatus() == Status.TAKEN)
            throw new InvalidAvailabilityIDException("Availability already taken");

        boolean isRitiroPassaporto = availabilityRequested
                .getRequest()
                .getRequestType()
                .getName()
                .equals("ritiro passaporto");

        ArrayList<Availability> rilascioPassaportiOfUser = availabilityRepository
                .findByUser(user)
                .stream()
                .filter(availability -> availability.getStatus() == Status.TAKEN)
                .filter(availability -> availability.getRequest()
                        .getRequestType()
                        .getName()
                        .equals("rilascio passaporto"))
                .sorted((availability1, availability2) ->
                        availability2.getDate().compareTo(availability1.getDate()))
                .collect(Collectors.toCollection(ArrayList::new));

        Date rilascioDatePlusOneMonth = DateUtils
                .addMonths(
                        rilascioPassaportiOfUser
                                .getLast()
                                .getDate(),
                        1
                );

        boolean isDateValid = !rilascioPassaportiOfUser.isEmpty() &&
                availabilityRequested
                        .getDate()
                        .after(rilascioDatePlusOneMonth);


        if (isRitiroPassaporto && !isDateValid)
            throw new InvalidAvailabilityIDException("Availability not valid for the request");


        availabilityRequested.setStatus(Status.TAKEN);
        availabilityRequested.setUser(user);

        availabilityRepository.save(availabilityRequested);

        return availabilityRequested;
    }

and this:

// UserQueryServiceImpl.java
    public ReportDetails getReportDetailsByAvailabilityID(String availabilityId, JWT token)
            throws SecurityException, InvalidAvailabilityIDException {
        Object userToken = jwtService.getUserOrWorkerFromToken(token);
        if (!(userToken instanceof User))
            throw new SecurityException("Only user can access reports");

        Optional<Availability> optionalAvailability = reservationRepository.findById(UUID.fromString(availabilityId));

        if (optionalAvailability.isEmpty())
            throw new InvalidAvailabilityIDException("Invalid Availability ID");

        Availability availability = optionalAvailability.get();
        if (!availability.getStatus().equals(Status.TAKEN))
            throw new InvalidAvailabilityIDException("Can't get report of free availabilities");

        User user = availability.getUser();
        String fiscalCodeAvailability = user.getFiscalCode();

        if (!fiscalCodeAvailability.equals(((User) userToken).getFiscalCode()))
            throw new SecurityException("Only user whose record belongs to can access it");

        Request request = availability.getRequest();
        Office office = availability.getOffice();
        RequestType requestType = request.getRequestType();

        return new ReportDetails(
                fiscalCodeAvailability,
                user.getName(),
                user.getSurname(),
                user.getCityOfBirth(),
                user.getDateOfBirth(),
                availability.getDate(),
                request.getStartTime(),
                requestType.getName(),
                office.getName(),
                office.getAddress()
        );
    }

[Security] Allocation of Resources Without Limits or Throttling

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

redis.clients:[email protected] › org.json:json@20230618

Description

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can cause indefinite amounts of memory to be used by inputting a string of modest size. This can lead to a Denial of Service.

Additional context

  • More information on the Snyk Report
  • Version 20231013 isn't vulnerable

[🚀 Feature] Dockerize the BackEnd

Dockerize the full stack application using Docker Compose V2.

Currently these parts runs on a container:

  • Postgres
  • Redis

These parts need to be modified:

  • Spring Boot

[Security] Information Exposure from GraphQL Dependency

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

com.graphql-java-kickstart:[email protected]

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.


Additional context

  • More information on the Snyk Report
  • As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".

[Security] Access Restriction Bypass

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

org.springframework.boot:[email protected]

The package in question is vulnerable to Access Restriction Bypass. If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.

The vulnerability is limited to the ROOT (default) web application.


Additional context

  • More information on the Snyk Report
  • It's fixed in org.apache.tomcat.embed:[email protected], @9.0.80, @10.1.13, @11.0.0-M11, but spring boot doesn't use any of these versions

[Security] Improper Certificate Validation

⚠️ Security Report

Description

Introduced through the Maven dependency in pom.xml file:

org.springframework.boot:[email protected]

Affected versions of this package are vulnerable to Improper Certificate Validation. Certificate hostname validation is disabled by default in Netty 4.1.x which makes it potentially susceptible to Man-in-the-Middle attacks.


Additional context

  • More information on the Snyk Report
  • This vulnerability is only applicable when certificate hostname validation is disabled.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.