fix(FSADT1-1234): adding zap on the CI for verification #829

paulushcgcj · 2024-03-04T18:33:10Z

Description

Fixing security issues reported by ZAP

Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

Further comments

Thanks for the PR!

Any successful deployments (not always required) will be available here

Once merged, code will be promoted and handed off to following workflow run.
Main Merge Workflow

Thanks for the PR!

Deployments, as required, will be available below:
Any successful deployments (not always required) will be available here

Please create PRs in draft mode. Mark as ready to enable:

Analysis Workflow

After merge, new images are deployed in:

Merge Workflow

github-actions · 2024-03-04T19:08:58Z

Current changelog

Bug Fixes

fixing caddy (51f60a8)
fixing caddy admin port (21c46d8)
fixing nonce hash (d19c405)
fixing notfound not returning 404 (fb19a89)
fixing sha (68f6bcc)
FSADT1-1234: adding cache contrl and strict transport (8973fe5)
FSADT1-1234: adding fam domain to connect-src (6690538)
FSADT1-1234: adding header customizer (2f71be2)
FSADT1-1234: adding nonce value (e190a56)
FSADT1-1234: adding Permission Policy header (8bb7c4d)
FSADT1-1234: adding sha loading for scripts (5884fc8)
FSADT1-1234: adding some missing headers (2844632)
FSADT1-1234: adding Strict-Transport-Security header (22d645f)
FSADT1-1234: fixing allowlist (0efedf5)
FSADT1-1234: fixing BE headers (749d395)
FSADT1-1234: fixing index file permission (098a7ad)
FSADT1-1234: removing eval (5be838a)
FSADT1-1234: updating headers (d474936)
FSADT1-1234: updating headers (a3130ae)
updating caddy (ce70efd)
zap:fe: fixing Content Security Policy (CSP) Header Not Set (a3c36ee)

github-actions · 2024-03-12T15:22:33Z

Overall Project	NaN% `NaN%`	🍏

There is no coverage information present for the Files changed

github-actions · 2024-03-12T17:15:54Z

Overall Project	NaN% `NaN%`	🍏

There is no coverage information present for the Files changed

github-actions · 2024-03-12T17:21:14Z

Frontend unit Test Coverage

Coverage after merging fix/FSADT1-1234 into main will be

57.09%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
App.vue	50%	50%	0%	70%	108, 36, 39–40, 44, 52–53, 61–62
directivesMap.ts	100%	100%	100%	100%
src/components
DataFetcher.vue	85%	60%	83.33%	95.83%	33–35, 50, 55
MainHeaderComponent.vue	81.48%	78.57%	70%	87.27%	105, 112, 116, 127, 129, 139, 141, 152, 178, 181, 190, 206, 222, 222, 222, 235, 246, 257, 44, 53–54, 58
UserProfileComponent.vue	80%	33.33%	100%	85.71%	17, 17, 19, 23
src/components/forms
AutoCompleteInputComponent.vue	76%	59.57%	84%	83.33%	112–113, 129, 134–135, 174, 179, 181–182, 226, 48, 61, 63, 63, 63, 63, 63–65, 67, 67, 67–69, 79, 82, 82, 82, 82, 82, 84, 86
DropdownInputComponent.vue	90.32%	89.19%	82.61%	93.75%	138, 153, 193, 69, 83, 83, 83–84
MultiselectInputComponent.vue	89.19%	83.33%	83.33%	94.74%	102, 111, 119, 126, 151, 43, 82, 91
RadioInputComponent.vue	82.56%	72.73%	80%	87.76%	101, 104, 106, 125, 41, 46, 78, 83–85, 93, 99
ReadOnlyComponent.vue	66.67%	100%	100%	66.67%	2
TextInputComponent.vue	86.21%	73.08%	86.67%	93.48%	1, 101–102, 110, 129, 136, 143, 146, 67, 96
src/components/forms/DateInputComponent
DateInputPart.vue	94.12%	80%	100%	100%	50, 66
common.ts	100%	100%	100%	100%
index.vue	77.78%	70.97%	75%	82.47%	1, 1, 139, 174–176, 184–187, 187, 187–188, 215, 217, 220–221, 227, 271–272, 282–283, 298–300, 302–303, 313–314, 318, 321–322, 332–335, 342, 354, 381, 381–383, 383, 383–386, 386, 386–387, 434, 455, 467, 475
src/components/grouping
AddressGroupComponent.vue	1.64%	0%	0%	3.54%	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 104–105, 107, 107, 107, 111–112, 114–115, 115, 115, 115, 117, 124, 131, 140–141, 141, 141, 141, 143, 145, 147, 151, 153–154, 154, 154–155, 155, 155, 155, 157, 159, 161, 164, 168–169, 169, 169, 171, 173, 177–178, 178, 178, 178, 180, 182, 184, 188–189, 189, 189, 19, 192, 194–195, 195–196, 196, 198, 201, 203–205, 205, 205, 205, 205–207, 215, 217–218, 221, 223, 228–229, 229, 229–234, 234, 234–236, 239, 253, 260, 260, 260–261, 261, 261–262, 262, 266, 270, 279, 28, 280, 280, 286, 286, 286, 288, 288, 288–289, 289, 289, 291, 291, 300, 308, 308, 308–309, 309, 309, 313, 331, 331, 331–332, 332, 332, 34, 347, 347, 347, 349, 349, 349, 35, 362, 365, 365, 365–366, 366, 366, 37, 370, 370, 373, 373, 373, 40, 42, 42, 42, 46, 46, 46, 49–51, 53–54, 57, 61–63, 66–68, 72, 76, 76, 76, 76, 76, 76–77, 82, 84, 87–88, 88, 88, 88, 88–89, 92, 95
ContactGroupComponent.vue	86.16%	93.44%	75.86%	84.06%	106–107, 130, 165, 182, 198, 217, 276, 42, 83–84, 90–91, 95–96
ErrorNotificationGroupingComponent.vue	76.32%	62.86%	66.67%	91.43%	110, 117, 117, 117, 121, 129, 129, 138, 147, 147, 153, 58, 63, 81, 90, 98
src/composables
useElementVisibility.ts	96.55%	87.50%	100%	100%	6
useFetch.ts	90.77%	73.68%	100%	97.56%	120, 124, 133, 18, 53, 90
useFocus.ts	46.91%	34.62%	50%	53.49%	120–121, 129–130, 130, 130–131, 133, 142, 145, 148, 34, 50, 55, 57, 60, 63, 63, 63, 65–67, 67, 67, 69, 71, 77, 77, 77, 80–81, 84, 93, 96, 99, 99, 99
useScreenSize.ts	100%	100%	100%	100%
useSvg.ts	100%	100%	100%	100%
src/helpers
CustomDirectives.ts	94.64%	86.96%	100%	100%	36, 43, 45
DataConversors.ts	73.81%	79.17%	33.33%	73.33%	34, 39, 39, 39, 39, 39–40, 45,

github-actions · 2024-03-12T17:21:15Z

Frontend component Test Coverage

Coverage after merging fix/FSADT1-1234 into main will be

79.82%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
App.vue	100%	100%	100%	100%
CoreConstants.ts	100%	100%	100%	100%
directivesMap.ts	100%	100%	100%	100%
main.ts	100%	100%	100%	100%
routes.ts	100%	100%	100%	100%
shims-vue.d.ts	100%	100%	100%	100%
src/components
DataFetcher.vue	100%	100%	100%	100%
MainHeaderComponent.vue	100%	100%	100%	100%
UserProfileComponent.vue	100%	100%	100%	100%
types.ts	100%	100%	100%	100%
src/components/forms
AutoCompleteInputComponent.vue	95.07%	92.31%	92%	97.44%	188, 226, 69, 82, 84
DropdownInputComponent.vue	98.29%	96.67%	95.65%	100%	113
MultiselectInputComponent.vue	83.96%	80%	75%	89.47%	102, 111, 126, 43, 49, 81–82, 82–84, 91
RadioInputComponent.vue	93.67%	86.67%	86.67%	97.96%	126, 41, 51
ReadOnlyComponent.vue	100%	100%	100%	100%
TextInputComponent.vue	96.34%	95.24%	93.33%	97.83%	110, 146
src/components/forms/DateInputComponent
DateInputPart.vue	84.38%	87.50%	33.33%	90.48%	66, 76–77
common.ts	100%	100%	100%	100%
index.vue	35.38%	32.43%	21.88%	39.61%	1, 1, 103, 103–105, 108, 108–110, 110, 110, 116, 116, 116, 116–117, 119, 122, 122, 124, 130, 130, 130, 130–131, 134, 139, 151, 163, 163, 166, 166, 174–176, 180–184, 184, 184, 184–187, 187–188, 191, 196, 201–203, 205, 205–206, 209–210, 215, 215, 217, 217, 217–218, 220, 220–221, 224–225, 227, 271, 271, 271, 271–272, 274–275, 282, 282–283, 285–287, 298–300, 302–303, 307–309, 311, 313, 313–314, 314, 314, 314, 318, 321, 321–322, 324, 332–335, 342, 342–344, 346–347, 349–350, 352, 354, 354–355, 360, 376–381, 381, 381, 381–383, 383–386, 386–387, 434, 443, 455, 467, 475
src/components/grouping
AddressGroupComponent.vue	91.25%	89.89%	97.37%	90.27%	115, 131, 141, 147, 154–155, 155, 155, 155, 157, 159, 161, 178, 184, 195, 217–218, 234, 266, 313
ContactGroupComponent.vue	91.67%	98.28%	86.21%	88.41%	232, 234, 263, 276, 84, 91, 95, 95–96
ErrorNotificationGroupingComponent.vue	100%	100%	100%	100%
src/composables
useElementVisibility.ts	100%	100%	100%	100%
useFetch.ts	100%	100%	100%	100%
useFocus.ts	100%	100%	100%	100%
useScreenSize.ts	100%	100%	100%	100%
useSvg.ts	100%	100%	100%	100%
src/dto
ApplyClientNumberDto.ts	100%	100%	100%	100%
CommonTypesDto.ts	100%	100%	100%	100%
src/helpers
CustomDirectives.ts	100%	100%	100%	100%
DataConversors.ts	100%	100%	100%	100%
ForestClientUserSession.ts	100%	100%	100%	100%
src/helpers/validators
BCeIDFormValidations.ts	100%	100%	100%	100%
GlobalValidators.ts	100%	100%	100%	100%
SubmissionValidators.ts	100%	100%	100%	100%
src/pages
ErrorPage.vue	100%	100%	100%	100%
FormBCSCPage.vue	100%	100%	100%	100%
FormBCeIDPage.vue	100%	100%	100%	100%
FormSubmittedPage.vue	100%	100%	100%	100%
LandingPage.vue	100%	100%	100%	100%
NotFoundPage.vue	100%	100%	100%	100%
SubmissionListPage.vue	100%	100%	100%	100%
SubmissionReviewPage.vue	100%	100%	100%	100%
UserLoadingPage.vue	100%	100%	100%	100%
src/pages/bceidform
AddressWizardStep.vue	87.50%	82.61%	84%	90.28%	137, 156, 160, 192, 49–50, 52, 52–53, 66–67
BusinessInformationWizardStep.vue	75.82%	74.80%	75.76%	76.67%	170–172, 187, 187–191, 194, 205, 205–207, 207–209, 212, 216, 219, 219, 219, 219, 219, 219, 219, 219, 219–221, 221, 221, 221–222, 222, 222, 222, 222–223, 225, 238, 249–252, 252, 252, 271, 275, 278, 291, 291–292, 325, 350, 357, 418, 428, 450, 499, 512, 516–517, 58, 93, 99
ContactWizardStep.vue	57.94%	61.54%	52%	58.67%	100, 104–106, 108–111, 143, 143, 143, 148, 168, 175, 179, 196, 198, 40, 40–41, 41, 41, 43–45, 48, 54–55, 64, 83–85, 85–86, 88, 94–96, 96–98
ReviewWizardStep.vue	100%	100%	100%	100%
src/services
ForestClientService.ts	100%	100%	100%	100%

github-actions · 2024-03-12T17:21:17Z

Frontend e2e Test Coverage

Coverage after merging fix/FSADT1-1234 into main will be

85.54%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src
App.vue	85.29%	83.33%	50%	100%	62
CoreConstants.ts	100%	100%	100%	100%
directivesMap.ts	100%	100%	100%	100%
main.ts	100%	100%	100%	100%
routes.ts	100%	100%	100%	100%
shims-vue.d.ts	100%	100%	100%	100%
src/components
DataFetcher.vue	100%	100%	100%	100%
MainHeaderComponent.vue	64.89%	77.27%	10%	60%	139, 178–181, 190, 202, 202, 202, 222, 235, 246, 257, 44, 44–45, 53, 53, 53, 53–54, 56–58, 58–59, 59, 59–60, 62, 75, 84, 90, 90, 90–91, 93
UserProfileComponent.vue	80%	33.33%	100%	85.71%	17, 17, 19, 23
types.ts	100%	100%	100%	100%
src/components/forms
AutoCompleteInputComponent.vue	95.07%	92.31%	92%	97.44%	188, 226, 69, 82, 84
DropdownInputComponent.vue	100%	100%	100%	100%
MultiselectInputComponent.vue	83.96%	80%	75%	89.47%	102, 111, 126, 43, 49, 81–82, 82–84, 91
RadioInputComponent.vue	93.67%	86.67%	86.67%	97.96%	126, 41, 51
ReadOnlyComponent.vue	100%	100%	100%	100%
TextInputComponent.vue	98.78%	95.24%	100%	100%	146
src/components/forms/DateInputComponent
DateInputPart.vue	96.88%	87.50%	100%	100%	66
common.ts	100%	100%	100%	100%
index.vue	80%	68.92%	93.75%	82.47%	1, 1, 110, 119, 122, 124, 139, 151, 205, 220, 227, 271–272, 282–283, 298–300, 302–303, 313–314, 318, 332–335, 342–344, 346–347, 349–350, 352, 354, 354–355, 381, 381–383, 383–386, 386–387, 434, 475
src/components/grouping
AddressGroupComponent.vue	91.25%	89.89%	97.37%	90.27%	115, 131, 141, 147, 154–155, 155, 155, 155, 157, 159, 161, 178, 184, 195, 217–218, 234, 266, 313
ContactGroupComponent.vue	97.44%	100%	96.55%	95.65%	276, 84, 91
ErrorNotificationGroupingComponent.vue	41.67%	16.13%	66.67%	60%	110, 110, 117, 117, 117, 121, 121, 129, 129, 138, 138, 147, 147, 153, 153, 166, 30–31, 31, 34, 58–59, 59, 63, 63–64, 64, 64, 66–67, 67, 69, 73–74, 74, 76, 90, 95, 98, 98
src/composables
useElementVisibility.ts	100%	100%	100%	100%
useFetch.ts	100%	100%	100%	100%
useFocus.ts	100%	100%	100%	100%
useScreenSize.ts	100%	100%	100%	100%
useSvg.ts	100%	100%	100%	100%
src/dto
ApplyClientNumberDto.ts	100%	100%	100%	100%
CommonTypesDto.ts	100%	100%	100%	100%
src/helpers
CustomDirectives.ts	100%	100%	100%	100%
DataConversors.ts	100%	100%	100%	100%
ForestClientUserSession.ts	100%	100%	100%	100%
src/helpers/validators
BCeIDFormValidations.ts	100%	100%	100%	100%
GlobalValidators.ts	100%	100%	100%	100%
SubmissionValidators.ts	100%	100%	100%	100%
src/pages
ErrorPage.vue	25%	100%	100%	25%	11–12, 2
FormBCSCPage.vue	84.73%	67.21%	80.49%	91.91%	1, 122–123, 144, 230, 292, 294, 303, 323, 328, 340, 340, 340, 342–343, 349, 354–356, 359, 359, 427, 51–53, 545, 552, 559, 590, 626, 626, 626, 64, 82
FormBCeIDPage.vue	61.90%	54.35%	42.42%	70.95%	1, 1, 1, 1, 1, 1, 100, 102, 105, 119, 119–120, 125, 125, 125, 128–129, 135, 242, 244, 253, 263–264, 264, 264, 264, 264, 264–267, 273, 279, 284, 284–289, 303, 303–304, 309, 309–310, 310–311, 311, 316, 322–323, 325, 325–327, 332–334, 344, 347–351, 361, 361, 363–365, 476, 483, 498, 506, 518, 528, 569, 569, 569, 588, 69–71, 95, 99
FormSubmittedPage.vue	61.11%	25%	0%	83.33%	12, 30, 32, 32, 32
LandingPage.vue	55.56%	37.50%	0%	73.68%	18, 18–19, 21, 21–22, 45, 51, 55, 55, 55, 61, 65, 65, 65
SubmissionListPage.vue	89.47%	81.25%	84.62%	93.62%	48, 48, 55, 95, 95–96
SubmissionReviewPage.vue	84.64%	80.17%	78%	89.76%	1, 103, 103–104, 119, 142, 171, 171–174, 178, 178, 192, 203, 203–204, 208, 212, 217, 217–218, 218, 218–219, 223, 229, 248–249, 265, 358, 361, 367, 448, 456, 558, 561, 616, 651, 677
UserLoadingPage.vue	50%	100%	100%	50%	12
src/pages/bceidform
AddressWizardStep.vue	89.17%	86.96%	84%	91.67%	137, 156, 160, 192, 49–50, 52, 52–53
BusinessInformationWizardStep.vue	87.58%	84.55%	93.94%	88.67%	170–172, 187, 187–191, 194, 219, 219, 219, 219, 221, 221–222, 222, 238, 249–252, 252, 252, 271, 275, 278, 350, 357, 418, 428, 450, 499, 58, 99
ContactWizardStep.vue	57.94%	61.54%	52%	58.67%	100, 104–106, 108–111, 143, 143, 143, 148, 168, 175, 179, 196, 198, 40, 40–41, 41, 41, 43–45, 48, 54–55, 64, 83–85, 85–86, 88, 94–96, 96–98

paulushcgcj · 2024-03-12T21:14:12Z

This PR will close #850 and #851

github-actions · 2024-03-12T21:17:41Z

Overall Project	NaN% `NaN%`	🍏

There is no coverage information present for the Files changed

github-actions · 2024-03-12T21:57:17Z

Overall Project	NaN% `NaN%`	🍏

There is no coverage information present for the Files changed

paulushcgcj · 2024-03-12T22:01:50Z

This one closes #850

paulushcgcj · 2024-03-12T22:01:58Z

This one closes #851

backend/src/main/java/ca/bc/gov/app/security/ForestHeadersCustomizer.java

ci: adding zap on the CI for verification

ddad87a

github-actions bot added the ci label Mar 4, 2024

paulushcgcj temporarily deployed to dev March 4, 2024 18:33 — with GitHub Actions Inactive

paulushcgcj temporarily deployed to dev March 4, 2024 18:40 — with GitHub Actions Inactive

fix(zap:fe): fixing Content Security Policy (CSP) Header Not Set

a3c36ee