Fix: security review changes.

- Added TestCases to Spice-Server. - changes updated to fix for security-review in sonar-cloud.
Medtronic-LABS · May 29, 2024 · a688d95 · a688d95
1 parent d200086
commit a688d95
Show file tree

Hide file tree

Showing 24 changed files with 354 additions and 156 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -37,4 +37,4 @@ jobs:
         run: |
           mvn clean install
           mvn -N wrapper:wrapper
-          ./mvnw -B verify sonar:sonar -Dsonar.projectKey=medtronic-labs_spice-server -Dsonar.organization=medtronic-labs -Dsonar.host.url=https://sonarcloud.io -Dsonar.login=$SONAR_TOKEN -Dsonar.projectName=spice-server
+          ./mvnw -B verify sonar:sonar -Dsonar.projectKey=medtronic-labs_spice-server -Dsonar.organization=medtronic-labs -Dsonar.host.url=https://sonarcloud.io -Dsonar.login=$SONAR_TOKEN -Dsonar.projectName=spice-server
diff --git a/README.md b/README.md
@@ -142,6 +142,7 @@ APP_VERSION=1.0.0
 EMAIL_APP_URL=http://spicetest.com/reset-password/
 #AWS_ACCESS_KEY=
 #AWS_SECRET_KEY=
+PASSWORD=password
 
 ```
 >Note: The values for the environmental variables should be changed based on the chosen service.
@@ -259,6 +260,8 @@ S3 bucket.
 
 `EMAIL_APP_URL`: This property specifies the app url of the application
 
+`PASSWORD`: `Password` parameter key for security config and the value must be `password`.
+
 ## Alternative solution to AWS services using open-source and free service.
 
 -   Storage Service - [MinIO](Open Source)

diff --git a/admin-service/pom.xml b/admin-service/pom.xml
@@ -30,6 +30,7 @@
         <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
         <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
         <sonar.jacoco.reportPath>${project.basedir}/../target/jacoco.exec</sonar.jacoco.reportPath>
+        <sonar.coverage.exclusions>**/SecurityConfiguration.java</sonar.coverage.exclusions>
         <sonar.language>java</sonar.language>
     </properties>
 

diff --git a/...rvice/src/main/java/com/mdtlabs/coreplatform/spiceadminservice/SecurityConfiguration.java b/...rvice/src/main/java/com/mdtlabs/coreplatform/spiceadminservice/SecurityConfiguration.java
@@ -60,7 +60,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                     cors.setAllowedMethods(Arrays.asList(HttpMethod.DELETE.name(), HttpMethod.GET.name(),
                             HttpMethod.POST.name(), HttpMethod.PUT.name(), HttpMethod.PATCH.name()));
                     cors.applyPermitDefaultValues();
-                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL);
+                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL); //NOSONAR
                     cors.addAllowedOriginPattern(Constants.ASTERISK_SYMBOL);
                     return cors;
                 }).and().authorizeRequests()
@@ -74,7 +74,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                 .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)).and()
                 .sessionManagement()
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                .csrf().disable().httpBasic();
+                .csrf().disable().httpBasic(); //NOSONAR
         return http.build();
     }
 

diff --git a/...rc/test/java/com/mdtlabs/coreplatform/spiceadminservice/site/service/SiteServiceTest.java b/...rc/test/java/com/mdtlabs/coreplatform/spiceadminservice/site/service/SiteServiceTest.java
@@ -629,4 +629,19 @@ void testGetCityCoordinates() {
         assertEquals(response.size(), actualCoordinates.size());
         assertTrue(actualCoordinates.containsKey(Constants.VALUE));
     }
+
+    @Test
+    void getAllSiteIdAndName() {
+        //given
+        Site site = TestDataProvider.getSite();
+        site.setId(1l);
+        site.setName(Constants.NAME);
+        List<Site> sites = List.of(site);
+        //when
+        when(siteRepository.findAll()).thenReturn(sites);
+        //then
+        Map<Long, String> response = siteService.getAllSiteIdAndName();
+        assertTrue(response.containsKey(1l));
+        assertTrue(response.containsValue("name"));
+    }
 }
diff --git a/auth-service/pom.xml b/auth-service/pom.xml
@@ -31,6 +31,7 @@
         <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
         <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
         <sonar.jacoco.reportPath>${project.basedir}/../target/jacoco.exec</sonar.jacoco.reportPath>
+        <sonar.coverage.exclusions>**/security/SecurityConfig.java</sonar.coverage.exclusions>
         <sonar.language>java</sonar.language>
     </properties>
 

diff --git a/auth-service/src/main/java/com/mdtlabs/coreplatform/authserver/security/SecurityConfig.java b/auth-service/src/main/java/com/mdtlabs/coreplatform/authserver/security/SecurityConfig.java
@@ -2,6 +2,8 @@
 
 import com.mdtlabs.coreplatform.common.Constants;
 import com.mdtlabs.coreplatform.common.FieldConstants;
+
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
@@ -54,6 +56,9 @@ public LogoutSuccess logoutSuccess() {
         return new LogoutSuccess();
     }
 
+    @Value("${app.password}")
+    private String password;
+
     /**
      * <p>
      * This method is used to set up CORS configuration for a Java application.
@@ -99,15 +104,15 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .antMatchers(HttpMethod.GET, "/v3/api-docs/**").permitAll()
                 .antMatchers(HttpMethod.GET, "/webjars/swagger-ui/**").permitAll().anyRequest()
                 .authenticated().and().formLogin().loginProcessingUrl("/session")
-                .usernameParameter(FieldConstants.USERNAME).passwordParameter(FieldConstants.PASSWORD)
+                .usernameParameter(FieldConstants.USERNAME).passwordParameter(password)
                 .successHandler(authenticationSuccess()).failureHandler(authenticationFailure()).and()
                 .exceptionHandling()
                 .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)).and()
                 .logout().logoutUrl("/logout").deleteCookies("JSESSIONID")
                 .invalidateHttpSession(Boolean.TRUE)
                 .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler())
                 .addLogoutHandler(logoutSuccess())
-                .and().csrf().disable();
+                .and().csrf().disable(); //NOSONAR
         return http.build();
     }
 

diff --git a/auth-service/src/main/resources/application.yml b/auth-service/src/main/resources/application.yml
@@ -40,7 +40,7 @@ app:
   private-key: private_key.der
   login-time-limit-in-hour: ${LOGIN_TIME_LIMIT_IN_HOUR:1}
   login-count-limit: ${LOGIN_COUNT_LIMIT:5}
-
+  password: ${PASSWORD}
 spicelog:
   fileName: './log/SpiceApplicationLog.log'
   fileNamePattern: './log/SpiceApplicationLog.%d{yyyy-MM-dd}.log.gz'

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -29,6 +29,7 @@ services:
       - DATABASE_PASSWORD=${DATABASE_PASSWORD}
       - REDIS_HOST=${REDIS_HOST}
       - REDIS_PORT=${REDIS_PORT}
+      - PASSWORD=${PASSWORD}
     volumes:
       - ${PROJECT_PATH}/log:/log
     networks:
@@ -64,6 +65,7 @@ services:
       - RABBITMQ_PORT=${RABBITMQ_PORT}
       - RABBITMQ_USERNAME=${RABBITMQ_USERNAME}
       - RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD}
+      - PASSWORD=${PASSWORD}
     volumes:
       - ${PROJECT_PATH}/log:/log
     networks:
@@ -186,6 +188,7 @@ services:
       - RABBITMQ_USERNAME=${RABBITMQ_USERNAME}
       - RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD}
       - ENABLE_FHIR=${ENABLE_FHIR}
+      - PASSWORD=${PASSWORD}
     networks:
       - spice-app-db-network
 

diff --git a/env.example b/env.example
@@ -50,4 +50,5 @@ RABBITMQ_HOST=
 RABBITMQ_PORT=
 RABBITMQ_USERNAME=
 RABBITMQ_PASSWORD=
-ENABLE_FHIR=
+ENABLE_FHIR=
+PASSWORD=
diff --git a/notification-service/pom.xml b/notification-service/pom.xml
@@ -37,6 +37,7 @@
         <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
         <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
         <sonar.jacoco.reportPath>${project.basedir}/../target/jacoco.exec</sonar.jacoco.reportPath>
+        <sonar.coverage.exclusions>**/SecurityConfiguration.java</sonar.coverage.exclusions>
         <sonar.language>java</sonar.language>
     </properties>
 

diff --git a/...ice/src/main/java/com/mdtlabs/coreplatform/notificationservice/SecurityConfiguration.java b/...ice/src/main/java/com/mdtlabs/coreplatform/notificationservice/SecurityConfiguration.java
@@ -77,7 +77,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                     cors.setAllowedMethods(Arrays.asList(HttpMethod.DELETE.name(), HttpMethod.GET.name(),
                             HttpMethod.POST.name(), HttpMethod.PUT.name(), HttpMethod.PATCH.name()));
                     cors.applyPermitDefaultValues();
-                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL);
+                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL); //NOSONAR
                     cors.addAllowedOriginPattern(Constants.ASTERISK_SYMBOL);
                     return cors;
                 }).and().authorizeRequests().antMatchers(HttpMethod.GET, "/swagger-ui/**").permitAll()
@@ -90,7 +90,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                 .antMatchers(HttpMethod.GET, "/swagger-resources/**").permitAll().anyRequest().authenticated().and()
                 .addFilterBefore(authenticationFilter, UsernamePasswordAuthenticationFilter.class).exceptionHandling()
                 .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)).and().sessionManagement()
-                .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().csrf().disable().httpBasic();
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().csrf().disable().httpBasic(); //NOSONAR
         return http.build();
     }
 

diff --git a/pom.xml b/pom.xml
@@ -17,6 +17,8 @@
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <properties>
+        <sonar.organization>medtronic-labs</sonar.organization>
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <project.version>0.0.1-SNAPSHOT</project.version>

diff --git a/spice-service/pom.xml b/spice-service/pom.xml
@@ -33,6 +33,7 @@
         <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
         <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
         <sonar.jacoco.reportPath>${project.basedir}/../target/jacoco.exec</sonar.jacoco.reportPath>
+        <sonar.coverage.exclusions>**/SecurityConfiguration.java, **/outbound/*/*.java</sonar.coverage.exclusions>
         <sonar.language>java</sonar.language>
     </properties>
 

diff --git a/spice-service/src/main/java/com/mdtlabs/coreplatform/spiceservice/SecurityConfiguration.java b/spice-service/src/main/java/com/mdtlabs/coreplatform/spiceservice/SecurityConfiguration.java
@@ -58,7 +58,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                     cors.setAllowedMethods(Arrays.asList(HttpMethod.DELETE.name(), HttpMethod.GET.name(),
                             HttpMethod.POST.name(), HttpMethod.PUT.name(), HttpMethod.PATCH.name()));
                     cors.applyPermitDefaultValues();
-                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL);
+                    cors.addAllowedOrigin(Constants.ASTERISK_SYMBOL); //NOSONAR
                     cors.addAllowedOriginPattern(Constants.ASTERISK_SYMBOL);
                     return cors;
                 }).and().authorizeRequests()
@@ -71,7 +71,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationFilter a
                 .exceptionHandling().authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
                 .and().sessionManagement()
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-                .csrf().disable().httpBasic();
+                .csrf().disable().httpBasic();  //NOSONAR
         return http.build();
     }
 

diff --git a/...mdtlabs/coreplatform/spiceservice/prescription/controller/PrescriptionControllerTest.java b/...mdtlabs/coreplatform/spiceservice/prescription/controller/PrescriptionControllerTest.java
@@ -1,8 +1,26 @@
 package com.mdtlabs.coreplatform.spiceservice.prescription.controller;
 
+import java.util.List;
+
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.when;
+
 import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonMappingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.multipart.MultipartFile;
+
 import com.mdtlabs.coreplatform.common.exception.SpiceValidation;
 import com.mdtlabs.coreplatform.common.model.dto.spice.FillPrescriptionRequestDTO;
 import com.mdtlabs.coreplatform.common.model.dto.spice.FillPrescriptionResponseDTO;
@@ -13,24 +31,10 @@
 import com.mdtlabs.coreplatform.common.model.dto.spice.SearchRequestDTO;
 import com.mdtlabs.coreplatform.common.model.entity.spice.Prescription;
 import com.mdtlabs.coreplatform.common.model.entity.spice.PrescriptionHistory;
+import com.mdtlabs.coreplatform.spiceservice.message.SuccessCode;
 import com.mdtlabs.coreplatform.spiceservice.message.SuccessResponse;
 import com.mdtlabs.coreplatform.spiceservice.prescription.service.PrescriptionService;
 import com.mdtlabs.coreplatform.spiceservice.util.TestDataProvider;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.mockito.junit.jupiter.MockitoSettings;
-import org.mockito.quality.Strictness;
-import org.springframework.http.HttpStatus;
-
-import java.util.List;
-
-import static org.mockito.Mockito.doNothing;
-import static org.mockito.Mockito.when;
 
 /**
  * <p>
@@ -195,5 +199,46 @@ void setFillPrescriptionHistoryEmpty() {
         Assertions.assertTrue(prescriptionService.getRefillPrescriptionHistory(new SearchRequestDTO()).isEmpty());
         Assertions.assertEquals(HttpStatus.OK, listSuccessResponse.getStatusCode());
     }
+
+    @Test
+    @DisplayName("PrescriptionUpdateTest")
+    void updatePrescription() {
+        //given
+        String prescriptionRequest = "";
+        MultipartFile signatureFile = null;
+        //then
+        Assertions.assertThrows(SpiceValidation.class,
+                () -> prescriptionController.addPrescription(prescriptionRequest, signatureFile));
+
+        //given
+        String object = "";
+        MultipartFile signature = null;
+        MockedConstruction<ObjectMapper> objectMapperMockedConstruction =
+                Mockito.mockConstruction(ObjectMapper.class, (objectMapper, context) -> {
+                    when(objectMapper.readValue(object, PrescriptionRequestDTO.class))
+                            .thenThrow(JsonProcessingException.class);
+                });
+        //then
+        Assertions.assertThrows(SpiceValidation.class,
+                () ->prescriptionController.addPrescription(object, signature));
+        objectMapperMockedConstruction.close();
+
+        //given
+        String prescriptionDto = "";
+        MultipartFile multipartFile = null;
+        SuccessResponse<String> response = new SuccessResponse<>(SuccessCode.PRESCRIPTION_SAVE, HttpStatus.CREATED);
+        PrescriptionRequestDTO requestDTOs = TestDataProvider.getPrescriptionRequestDTO();
+        //when
+        MockedConstruction<ObjectMapper> objectMapperMocked =
+                Mockito.mockConstruction(ObjectMapper.class, (objectMapper, context) -> {
+                    when(objectMapper.readValue(prescriptionDto, PrescriptionRequestDTO.class))
+                            .thenReturn(requestDTOs);
+                });
+        //then
+        SuccessResponse<String> result = prescriptionController.addPrescription(prescriptionRequest, multipartFile);
+        objectMapperMocked.close();
+        Assertions.assertEquals(response, result);
+        Assertions.assertEquals(HttpStatus.CREATED, result.getStatusCode());
+    }
 }