View Code? Open in Web Editor
NEW
BackEnd of a computer system to manage the reservation service for passport issuance for a Police Headquarters, which has multiple locations in the territory.
Home Page: https://francesco146.github.io/BE-PassportEase/
License: MIT License
Java 99.70%
Dockerfile 0.30%
be-passportease's Introduction
Hi ๐! My name is Francesco and I'm a undergraduate here in UniVR, from Italy
be-passportease's People
Watchers
be-passportease's Issues
Refactor this:
// UserMutationServiceImpl.java
public Availability createReservation (UUID availabilityId , User user )
throws UserNotFoundException , AvailabilityNotFoundException , InvalidAvailabilityIDException {
Optional <Availability > availabilityOptional = availabilityRepository .findById (availabilityId );
if (!userRepository .existsById (user .getId ())) throw new UserNotFoundException ("User not found" );
if (availabilityOptional .isEmpty ()) throw new AvailabilityNotFoundException ("Availability not found" );
Availability availabilityRequested = availabilityOptional .get ();
if (availabilityRequested .getStatus () == Status .TAKEN )
throw new InvalidAvailabilityIDException ("Availability already taken" );
boolean isRitiroPassaporto = availabilityRequested
.getRequest ()
.getRequestType ()
.getName ()
.equals ("ritiro passaporto" );
ArrayList <Availability > rilascioPassaportiOfUser = availabilityRepository
.findByUser (user )
.stream ()
.filter (availability -> availability .getStatus () == Status .TAKEN )
.filter (availability -> availability .getRequest ()
.getRequestType ()
.getName ()
.equals ("rilascio passaporto" ))
.sorted ((availability1 , availability2 ) ->
availability2 .getDate ().compareTo (availability1 .getDate ()))
.collect (Collectors .toCollection (ArrayList ::new ));
Date rilascioDatePlusOneMonth = DateUtils
.addMonths (
rilascioPassaportiOfUser
.getLast ()
.getDate (),
1
);
boolean isDateValid = !rilascioPassaportiOfUser .isEmpty () &&
availabilityRequested
.getDate ()
.after (rilascioDatePlusOneMonth );
if (isRitiroPassaporto && !isDateValid )
throw new InvalidAvailabilityIDException ("Availability not valid for the request" );
availabilityRequested .setStatus (Status .TAKEN );
availabilityRequested .setUser (user );
availabilityRepository .save (availabilityRequested );
return availabilityRequested ;
}
and this:
// UserQueryServiceImpl.java
public ReportDetails getReportDetailsByAvailabilityID (String availabilityId , JWT token )
throws SecurityException , InvalidAvailabilityIDException {
Object userToken = jwtService .getUserOrWorkerFromToken (token );
if (!(userToken instanceof User ))
throw new SecurityException ("Only user can access reports" );
Optional <Availability > optionalAvailability = reservationRepository .findById (UUID .fromString (availabilityId ));
if (optionalAvailability .isEmpty ())
throw new InvalidAvailabilityIDException ("Invalid Availability ID" );
Availability availability = optionalAvailability .get ();
if (!availability .getStatus ().equals (Status .TAKEN ))
throw new InvalidAvailabilityIDException ("Can't get report of free availabilities" );
User user = availability .getUser ();
String fiscalCodeAvailability = user .getFiscalCode ();
if (!fiscalCodeAvailability .equals (((User ) userToken ).getFiscalCode ()))
throw new SecurityException ("Only user whose record belongs to can access it" );
Request request = availability .getRequest ();
Office office = availability .getOffice ();
RequestType requestType = request .getRequestType ();
return new ReportDetails (
fiscalCodeAvailability ,
user .getName (),
user .getSurname (),
user .getCityOfBirth (),
user .getDateOfBirth (),
availability .getDate (),
request .getStartTime (),
requestType .getName (),
office .getName (),
office .getAddress ()
);
}
โ ๏ธ Security Report
Description
Introduced through the Maven dependency in pom.xml
file:
org.springframework.boot:[email protected]
The package in question is vulnerable to Access Restriction Bypass. If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.
The vulnerability is limited to the ROOT (default) web application.
Additional context
More information on the Snyk Report
It's fixed in org.apache.tomcat.embed:[email protected]
, @9.0.80
, @10.1.13
, @11.0.0-M11
, but spring boot doesn't use any of these versions
โ ๏ธ Security Report
Description
Introduced through the Maven dependency in pom.xml
file:
com.graphql-java-kickstart:[email protected]
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
Additional context
More information on the Snyk Report
As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being usable, this advisory is kept as "unfixed".
โ ๏ธ Security Report
Description
Introduced through the Maven dependency in pom.xml
file:
redis.clients:[email protected] โบ org.json:json@20230618
Description
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can cause indefinite amounts of memory to be used by inputting a string of modest size. This can lead to a Denial of Service.
Additional context
More information on the Snyk Report
Version 20231013 isn't vulnerable
โ ๏ธ Security Report
Description
Introduced through the Maven dependency in pom.xml
file:
org.springframework.boot:[email protected]
Affected versions of this package are vulnerable to Improper Certificate Validation. Certificate hostname validation is disabled by default in Netty 4.1.x which makes it potentially susceptible to Man-in-the-Middle attacks.
Additional context
More information on the Snyk Report
This vulnerability is only applicable when certificate hostname validation is disabled.
Dockerize the full stack application using Docker Compose V2.
Currently these parts runs on a container:
These parts need to be modified: