Add new contact controller

[nahsra]

Adds 2 new endpoints to manage contacts!

[sonarcloud[bot]]

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarCloud

[sonarcloud[bot]]

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarCloud

[pixeebot[bot]]

Triage summary :sparkles:

Sonar found 3 issue(s) and I was able to help with 3 of them. We think 1 is lower severity than what's being reported.

• Make sure this weak hash algorithm is not used in a sensitive context here.

  Finding ID: AZDcdTTNttZYSqwUcvr4 :triangular_flag_on_post: True Positive

  
  Suggestion: Change Status to True Positive
  The `updatePassword` method in the `ContactController` class uses the MD5 hashing algorithm to hash user passwords. MD5 is outdated and vulnerable to attacks, making it unsuitable for secure password storage. It is recommended to replace MD5 with a more secure hashing algorithm like bcrypt to enhance password security. The hashing function is used to securely store the password in a hashed form, ensuring plaintext passwords are not stored in the database. The input to the hashing function is `newPassword1`, and the hashed password is converted to a hexadecimal string before being passed to `userDao.updatePassword`. ```java 27: String updatePassword(String newPassword1, String newPassword2) throws SQLException { 28: if(!newPassword1.equals(newPassword2)) { 29: return "nomatch"; 30: } 31: MessageDigest md = MessageDigest.getInstance("MD5"); 32: byte[] b = md.digest(newPassword1.getBytes("UTF-8")); 33: String hexMd5 = toHexString(b); 34: return userDao.updatePassword(getContext(), hexMd5); ``` The use of MD5 for password hashing is a serious security risk. It is crucial to replace MD5 with a more secure hashing algorithm to mitigate this risk.

• Make sure allowing safe and unsafe HTTP methods is safe here.

  Finding ID: AZDcdTTNttZYSqwUcvr0 :arrow_down: LOW

  
  Suggestion: Change Severity to LOW
  The tool is saying that this endpoint has a potential Cross-Site Request Forgery (CSRF) vulnerability because it supports multiple HTTP methods. Supporting multiple HTTP methods is not an accurate way of determining whether this code is vulnerable to CSRF. This endpoint in particular supports only GET and POST. An attacker who can force a user to execute a GET request (via embedded image on a malicious page, for example) can almost always also force you to execute a POST request (via an auto-posting form). Although this trait can make exploitation of some CSRF attacks easier, it is not sufficient evidence alone to suggest that it is vulnerable or worth investigating further. Being vulnerable to CSRF requires the ability to execute a state-changing operation without the verification of a short-lived token, and without verification that the HTTP traffic is of a particular type. The role of HTTP methods in this analysis is a very limited one. It should also be noted that CSRF is an extraordinarily difficult vulnerability to detect through automation. All of the time spent triaging CSRF issues manually is most likely better spent on investing into utilizing universal anti-CSRF controls likely built into your application's framework, testing them, and observing their performance in production.
  Finding ID: AZDcdTTNttZYSqwUcvr1 :no_bell: False Positive

  
  Suggestion: Change Status to False Positive
  The tool is saying that this method is a potential Cross-Site Request Forgery (CSRF) vulnerability. However, our analysis suggests that this controller method doesn't take any user input as parameters. There are esoteric examples of CSRF attacks that don't require input, but they are generally much lower risk (e.g., logout CSRF). It should also be noted that CSRF is an extraordinarily difficult vulnerability to detect through automation. All of the time spent triaging CSRF issues manually is most likely better spent on investing into utilizing universal anti-CSRF controls likely built into your application's framework, testing them, and observing their performance in production.

  🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Configure