[PM-5157] Update Duo metadata #9196

ike-kottlowski · 2024-05-15T17:38:45Z

Type of change

- [ ] Bug fix
- [ ] New feature development
- [x] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Change naming of Duo 2FA Parameters.

Code changes

messaged.json: added new entry for ClientId and ClientSecret to replace the old IntegrationKey and SecretKey
All other code changes are name changes.

Screenshots

Before you submit

Please add unit tests where it makes sense to do so (encouraged but not required)
If this change requires a documentation update - notify the documentation team
If this change has particular deployment requirements - notify the DevOps team
Ensure that all UI additions follow WCAG AA requirements

codecov · 2024-05-15T17:45:58Z

Codecov Report

Attention: Patch coverage is 0% with 6 lines in your changes are missing coverage. Please review.

Project coverage is 28.11%. Comparing base (25f55e1) to head (4cd3edd).

Files	Patch %	Lines
.../src/app/auth/settings/two-factor-duo.component.ts	0.00%	4 Missing ⚠️
...rc/auth/models/response/two-factor-duo.response.ts	0.00%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9196   +/-   ##
=======================================
  Coverage   28.10%   28.11%           
=======================================
  Files        2431     2431           
  Lines       70390    70390           
  Branches    13128    13128           
=======================================
+ Hits        19781    19788    +7     
+ Misses      49082    49075    -7     
  Partials     1527     1527

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-05-15T18:02:33Z

Checkmarx One – Scan Summary & Details – 571da482-3d3e-4237-a78d-dcec58bbb314

New Issues

Issue	Source File / Package	Checkmarx Insight
Angular_Improper_Type_Pipe_Usage	/apps/web/src/app/billing/organizations/adjust-subscription.component.html: 54	Attack Vector
Angular_Improper_Type_Pipe_Usage	/apps/web/src/app/billing/organizations/adjust-subscription.component.html: 18	Attack Vector
Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/pin-crypto-service.factory.ts: 47	Attack Vector
Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/background/service-factories/vault-timeout-service.factory.ts: 97	Attack Vector
Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/cli/src/platform/services/node-env-secure-storage.service.ts: 81	Attack Vector
Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/cli/src/platform/services/node-env-secure-storage.service.ts: 62	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	Client_DOM_Code_Injection	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Code_Injection	/apps/browser/src/autofill/services/collect-autofill-content.service.ts: 1054
	Client_DOM_Stored_XSS	/apps/web/src/connectors/sso.ts: 33
	Client_DOM_XSS	/apps/browser/src/auth/scripts/duo.js: 285
	Client_DOM_XSS	/apps/browser/src/auth/scripts/duo.js: 285
	Client_DOM_XSS	/apps/desktop/src/auth/scripts/duo.js: 285
	Client_DOM_XSS	/apps/desktop/src/auth/scripts/duo.js: 285
	Client_DOM_XSS	/apps/web/src/connectors/common.ts: 2
	Client_DOM_XSS	/apps/web/src/connectors/common.ts: 2
	Client_DOM_XSS	/apps/web/src/connectors/common.ts: 2
	Client_DOM_XSS	/apps/web/src/connectors/common.ts: 2
	Client_DOM_XSS	/apps/web/src/connectors/sso.ts: 21
	Client_DOM_XSS	/apps/web/src/connectors/sso.ts: 19
	Client_DOM_XSS	/apps/web/src/connectors/sso.ts: 15
	Absolute_Path_Traversal	/apps/cli/src/commands/serve.command.ts: 315
	Absolute_Path_Traversal	/apps/cli/src/commands/serve.command.ts: 347
	Absolute_Path_Traversal	/apps/cli/src/commands/serve.command.ts: 315
	Absolute_Path_Traversal	/apps/cli/src/commands/serve.command.ts: 347
	Angular_Improper_Type_Pipe_Usage	/bitwarden_license/bit-web/src/app/admin-console/providers/setup/setup.component.html: 28
	Angular_Improper_Type_Pipe_Usage	/bitwarden_license/bit-web/src/app/admin-console/providers/setup/setup.component.html: 1
	Angular_Improper_Type_Pipe_Usage	/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.html: 1
	Client_Privacy_Violation	/apps/browser/src/background/runtime.background.ts: 308
	Client_Privacy_Violation	/apps/web/src/app/tools/reports/pages/breach-report.component.html: 14
	Client_Privacy_Violation	/apps/browser/src/auth/popup/account-switching/account.component.ts: 12
	Client_Privacy_Violation	/apps/browser/src/auth/popup/account-switching/account.component.ts: 12
	Client_Privacy_Violation	/apps/browser/src/auth/popup/account-switching/account.component.ts: 12
	Client_Privacy_Violation	/libs/components/src/color-password/color-password.component.ts: 25
	Client_Privacy_Violation	/libs/components/src/color-password/color-password.component.ts: 26
	Client_Privacy_Violation	/apps/desktop/src/auth/lock.component.html: 32
	Client_Privacy_Violation	/apps/web/src/app/auth/lock.component.html: 18
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.ts: 135
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.ts: 70
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.ts: 80
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.ts: 146
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.ts: 30
	Client_Privacy_Violation	/apps/web/src/app/auth/lock.component.html: 18
	Client_Privacy_Violation	/apps/desktop/src/auth/lock.component.html: 32
	Client_Privacy_Violation	/apps/web/src/app/auth/recover-two-factor.component.html: 37
	Client_Privacy_Violation	/apps/web/src/app/billing/shared/add-credit.component.html: 46
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/view.component.html: 534
	Client_Privacy_Violation	/apps/web/src/connectors/webauthn-fallback.ts: 116
	Client_Privacy_Violation	/bitwarden_license/bit-web/src/app/auth/sso/sso.component.ts: 161
	Client_Privacy_Violation	/bitwarden_license/bit-web/src/app/auth/sso/sso.component.ts: 161
	Client_Privacy_Violation	/libs/components/src/color-password/color-password.component.ts: 14
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/view.component.html: 60
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/view.component.html: 56
	Client_Privacy_Violation	/apps/browser/src/tools/popup/generator/password-generator-history.component.html: 26
	Client_Privacy_Violation	/apps/browser/src/vault/popup/components/vault/password-history.component.html: 18
	Client_Privacy_Violation	/apps/desktop/src/app/tools/password-generator-history.component.html: 15
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/password-history.component.html: 12
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/view.component.html: 50
	Client_Privacy_Violation	/libs/components/src/color-password/color-password.component.ts: 14
	Client_Privacy_Violation	/apps/browser/src/tools/popup/generator/password-generator-history.component.html: 26
	Client_Privacy_Violation	/apps/browser/src/vault/popup/components/vault/password-history.component.html: 18
	Client_Privacy_Violation	/apps/desktop/src/app/tools/password-generator-history.component.html: 15
	Client_Privacy_Violation	/apps/desktop/src/vault/app/vault/password-history.component.html: 12
	Missing_HSTS_Header	/apps/cli/src/auth/commands/login.command.ts: 705
	SSRF	/libs/importer/src/importers/lastpass/access/services/rest-client.ts: 69
	SSRF	/libs/importer/src/importers/lastpass/access/services/rest-client.ts: 69
	Angular_Usage_of_Unsafe_DOM_Sanitizer	/apps/desktop/src/app/components/avatar.component.ts: 75
	Angular_Usage_of_Unsafe_DOM_Sanitizer	/libs/components/src/avatar/avatar.component.ts: 80
	Angular_Usage_of_Unsafe_DOM_Sanitizer	/libs/components/src/icon/icon.component.ts: 18
	Angular_Usage_of_Unsafe_DOM_Sanitizer	/libs/components/src/icon/icon.component.ts: 18
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/accessibility-cookie.component.html: 18
	Client_DOM_Open_Redirect	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Open_Redirect	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Open_Redirect	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Open_Redirect	/apps/web/src/connectors/sso.ts: 21
	Client_DOM_Open_Redirect	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Open_Redirect	/apps/web/src/connectors/sso.ts: 19
	Client_DOM_Open_Redirect	/apps/web/src/connectors/common.ts: 2
	Client_DOM_Open_Redirect	/apps/web/src/connectors/sso.ts: 15
	Client_DOM_Open_Redirect	/apps/browser/src/tools/popup/generator/password-generator-history.component.ts: 18
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/account-switching/current-account.component.ts: 31
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/login/login-via-auth-request.component.ts: 62
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/login/login-via-auth-request.component.ts: 62
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/account-switching/account.component.ts: 24
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/login-via-auth-request.component.ts: 54
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/login-via-auth-request.component.ts: 54
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/login/login-via-auth-request.component.ts: 62
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/login/login-via-auth-request.component.ts: 62
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/login-via-auth-request.component.ts: 54
	Client_DOM_Open_Redirect	/apps/browser/src/auth/popup/login-via-auth-request.component.ts: 54
	Client_DOM_Open_Redirect	/apps/browser/src/vault/popup/components/vault/password-history.component.ts: 21
	Client_DOM_Open_Redirect	/apps/browser/src/billing/popup/settings/premium.component.ts: 27
	Client_DOM_Open_Redirect	/apps/browser/src/vault/popup/components/vault/attachments.component.ts: 32
	Client_DOM_Open_Redirect	/libs/common/src/auth/iframe-component.ts: 49
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/libs/common/src/auth/webauthn-iframe.ts: 25
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/libs/common/src/auth/webauthn-iframe.ts: 25
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/desktop/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_DOM_Open_Redirect	/apps/browser/src/auth/scripts/duo.js: 277
	Client_Hardcoded_Domain	/apps/web/src/app/billing/shared/payment.component.ts: 56
	Client_Hardcoded_Domain	/apps/web/src/app/billing/shared/payment.component.ts: 56
	Client_Hardcoded_Domain	/apps/web/src/connectors/captcha.ts: 57
	Client_Use_Of_Iframe_Without_Sandbox	/apps/browser/src/autofill/content/notification-bar.ts: 868
	Client_Use_Of_Iframe_Without_Sandbox	/apps/browser/src/autofill/overlay/iframe-content/autofill-overlay-iframe.service.ts: 90
	Client_Use_Of_Iframe_Without_Sandbox	/apps/web/src/connectors/duo.ts: 8
	Client_Use_Of_Iframe_Without_Sandbox	/apps/web/src/connectors/duo.ts: 8
	Client_Weak_Cryptographic_Hash	/libs/common/src/platform/services/web-crypto-function.service.ts: 142
	Client_Weak_Cryptographic_Hash	/apps/desktop/src/proxy/ipc.ts: 24
	Missing_CSP_Header	/apps/cli/src/auth/commands/login.command.ts: 705
	Unprotected_Cookie	/apps/web/src/app/auth/two-factor.component.ts: 143
	Unprotected_Cookie	/apps/web/src/connectors/duo-redirect.ts: 57
	Unprotected_Cookie	/apps/web/src/connectors/duo-redirect.ts: 112
	Unprotected_Cookie	/apps/web/src/connectors/sso.ts: 33
	Unprotected_Cookie	/apps/web/src/app/auth/sso.component.ts: 137
	Unsafe_Use_Of_Target_blank	/apps/web/src/app/auth/settings/two-factor-recovery.component.ts: 25
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/pin-service.factory.ts: 64
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/device-trust-service.factory.ts: 83
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/device-trust-service.factory.ts: 82
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/auth-request-service.factory.ts: 54
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/login-strategy-service.factory.ts: 130
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/tools/background/service_factories/import-service.factory.ts: 63
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/platform/background/service-factories/key-generation-service.factory.ts: 23
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/user-verification-service.factory.ts: 77
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/auth-service.factory.ts: 51
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/auth/background/service-factories/key-connector-service.factory.ts: 70
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/background/service-factories/send-service.factory.ts: 50
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/background/service-factories/vault-timeout-settings-service.factory.ts: 73
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/platform/background/service-factories/crypto-service.factory.ts: 78
	Use_of_Broken_or_Risky_Cryptographic_Algorithm	/apps/browser/src/vault/background/service_factories/cipher-service.factory.ts: 75
	Use_of_Broken_or_Risky_Cryptographic_Algorithm

More results are available on AST platform

ike-kottlowski · 2024-05-16T23:47:48Z

closing since this PR is out of scope for the task PM-5157

ike-kottlowski added 3 commits May 8, 2024 08:11

initial name changes

8b82f11

added v2 duo metadata

d181c34

remove v2 params

6eb4080

ike-kottlowski requested a review from a team as a code owner May 15, 2024 17:38

ike-kottlowski requested a review from JaredSnider-Bitwarden May 15, 2024 17:38

Merge branch 'main' into auth/pm-5157/update-duo-metadata

4cd3edd

github-actions bot added the needs-qa Marks a PR as requiring QA approval label May 15, 2024

ike-kottlowski changed the title ~~Auth/pm 5157/update duo metadata~~ [PM-5157] Update Duo metadata May 15, 2024

ike-kottlowski marked this pull request as draft May 15, 2024 17:52

ike-kottlowski closed this May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PM-5157] Update Duo metadata #9196

[PM-5157] Update Duo metadata #9196

ike-kottlowski commented May 15, 2024

codecov bot commented May 15, 2024

github-actions bot commented May 15, 2024 •

edited

ike-kottlowski commented May 16, 2024 •

edited

[PM-5157] Update Duo metadata #9196

[PM-5157] Update Duo metadata #9196

Conversation

ike-kottlowski commented May 15, 2024

Type of change

Objective

Code changes

Screenshots

Before you submit

codecov bot commented May 15, 2024

Codecov Report

github-actions bot commented May 15, 2024 • edited

New Issues

Fixed Issues

ike-kottlowski commented May 16, 2024 • edited

github-actions bot commented May 15, 2024 •

edited

ike-kottlowski commented May 16, 2024 •

edited