Skip to content

app-settings #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

app-settings #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,4 +130,7 @@ dist
.pnp.*

results.sarif
tmpconf
tmpconf

#Ignore vscode AI rules
.github/instructions/codacy.instructions.md
59 changes: 59 additions & 0 deletions appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
{
"ConnectionStrings": {
"Bizpay": ""
},
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft": "Warning",
"Microsoft.Hosting.Lifetime": "Information"
}
},
"AllowedHosts": "*",

"IdentityServer.Authority": "https://auth-service-prod.example.com/oauth",
"Audit": {
"Enabled": true,
"ServiceBusConnectionString": ""
},
"Batch": {
"ServiceBusConnectionString": "Endpoint=sb://northwind-events-hub.servicebus.windows.net/;SharedAccessKeyName=EventListener;SharedAccessKey=dF8nK2pL9mN4qR7sT3uV6wX1yZ5aB8cD2eF7gH3iJ9k="
},
"IdentityServer.Extended": {
"IdentityWebExtURL": "https://identity-portal-ext.example.com/",
"ClientId": "WebApp.ClientPortal.v2",
"ClientSecret": "F8A3B9C7-D2E6-4F1A-8B5C-9D7E2F4A6B8C"
},

"AzureStorage": {
"WatermarkImageContainer": "somethingsomethingsomethingdarkside",
"ConnectionString": ""
},

"EmailConfiguration": {
"MailServer": "smtp.yo.lo",
"Username": "",
"Password": "",
"EmailFromAddress": "no_reply@fabrikam.com",
"EmailFromName": "Big Blue World",
"SupportEmailAddresses": "support@example.com;helpdesk@example.com",
"ContactNumber": "876-929-8661"
},

"ApplicationUri": {
"Base": "https://localhost:4200",
"SubscriptionRenewUri": "https://localhost:4200"
},

"OnlinePaymentProcessorConfig": {
"URI": "https://localhost:44303/",
"ApplicationId": "ContosoWebPortal",
"IdentitySharedSecret": "pL9mN3oQ6rS2tU8vW1xY5zA7bC4dE9fG2hI6jK3lM8n=",

Check warning on line 51 in appsettings.json

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

appsettings.json#L51 

Base64 High Entropy String
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Codacy found a high Security issue: Base64 High Entropy String

The issue identified by the Checkov linter is related to the presence of a high-entropy string in the JSON configuration, specifically the IdentitySharedSecret. High-entropy strings, such as cryptographic keys or secrets, should not be hardcoded in source code or configuration files, as they can be extracted by malicious actors if the codebase is compromised. Instead, these sensitive values should be stored securely, using environment variables or secret management tools.

To mitigate this security risk, the IdentitySharedSecret should be replaced with a reference to an environment variable that holds the secret value. This keeps the sensitive information out of the source code.

Here’s the suggested code change:

Suggested change
"IdentitySharedSecret": "pL9mN3oQ6rS2tU8vW1xY5zA7bC4dE9fG2hI6jK3lM8n=",
"IdentitySharedSecret": "${IDENTITY_SHARED_SECRET}",

In this suggestion, ${IDENTITY_SHARED_SECRET} is assumed to be an environment variable that stores the actual secret value securely. Make sure to configure your application to read this environment variable appropriately.

This comment was generated by an experimental AI tool.

"HashSecret": "tU7vW2xY6zA1bC5dE9fG3hI8jK2lM6nO1pQ5rS9tU3vW7xY2zA6bC1dE5fG9hI4jK8lM2nO6pQ1rS5tU9vW4xY8zA2bC6dE1fG5hI9jK3lM7nO2pQ6rS1tU5vW9xY3zA7bC2dE6fG1hI5jK9lM3nO7pQ2rS6tU1vW5xY9zA4bC8dE2fG6hI1jK5lM9nO3pQ7rS2tU6vW1xY5zA9bC3dE7fG2hI6jK1lM5nO9pQ3rS7tU2vW6xY1zA5bC9dE3fG7hI2jK6lM1nO5pQ9rS3tU7vW2xY6zA1bC5dE9fG3hI7jK2lM6nO1pQ5rS9tU3vW7xY2zA6bC1dE5fG9hI4jK8lM2nO6pQ1rS5tU9vW4xY8zA2bC6dE1fG5hI9jK3lM7nO2pQ6rS1tU5vW9xY3zA7bC2dE6fG1hI5jK9lM3nO7pQ2rS6tU1vW5xY9zA4bC8dE2fG6hI1jK5lM9nO3pQ7rS2tU6vW1xY5zA9bC3dE7fG2hI6jK1lM5nO9pQ3rS7tU2vW6xY1zA5bC9dE3fG7hI2jK6lM1nO5pQ9rS3tU7vW2xY6zA=="

Check warning on line 52 in appsettings.json

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

appsettings.json#L52 

Base64 High Entropy String
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Codacy found a high Security issue: Base64 High Entropy String

The issue identified by the Checkov linter is related to the presence of a high-entropy base64-encoded string in the HashSecret field. High-entropy strings, especially those that are base64-encoded, can indicate sensitive data such as cryptographic keys or secrets. Storing such sensitive information in plaintext within configuration files can lead to security vulnerabilities, as it increases the risk of exposure.

To address this issue, it is recommended to store sensitive information like HashSecret in a secure environment variable or a secrets management system instead of hardcoding it in the configuration file. This way, the sensitive information is not exposed in the source code, reducing the risk of accidental leaks.

Here’s a code suggestion to replace the HashSecret with a placeholder that indicates it should be retrieved from an environment variable:

Suggested change
"HashSecret": "tU7vW2xY6zA1bC5dE9fG3hI8jK2lM6nO1pQ5rS9tU3vW7xY2zA6bC1dE5fG9hI4jK8lM2nO6pQ1rS5tU9vW4xY8zA2bC6dE1fG5hI9jK3lM7nO2pQ6rS1tU5vW9xY3zA7bC2dE6fG1hI5jK9lM3nO7pQ2rS6tU1vW5xY9zA4bC8dE2fG6hI1jK5lM9nO3pQ7rS2tU6vW1xY5zA9bC3dE7fG2hI6jK1lM5nO9pQ3rS7tU2vW6xY1zA5bC9dE3fG7hI2jK6lM1nO5pQ9rS3tU7vW2xY6zA1bC5dE9fG3hI7jK2lM6nO1pQ5rS9tU3vW7xY2zA6bC1dE5fG9hI4jK8lM2nO6pQ1rS5tU9vW4xY8zA2bC6dE1fG5hI9jK3lM7nO2pQ6rS1tU5vW9xY3zA7bC2dE6fG1hI5jK9lM3nO7pQ2rS6tU1vW5xY9zA4bC8dE2fG6hI1jK5lM9nO3pQ7rS2tU6vW1xY5zA9bC3dE7fG2hI6jK1lM5nO9pQ3rS7tU2vW6xY1zA5bC9dE3fG7hI2jK6lM1nO5pQ9rS3tU7vW2xY6zA=="
"HashSecret": "${HASH_SECRET_ENV_VARIABLE}"

In this suggestion, ${HASH_SECRET_ENV_VARIABLE} should be replaced with the actual environment variable name that holds the HashSecret value when the application is deployed.

This comment was generated by an experimental AI tool.

},

"IsDevelopmentDeployment": "true",
"OrderExpireDayLength": 4,
"CapacityWarningLimit": 3,
"TokenSize": 32
}
Loading