0.1.0 rc #15
0.1.0 rc #15
Conversation
…n McpTools. Implement integration tests for webhook-triggered analysis and incremental analysis. Update OAuthCallbackController to streamline redirect URLs. Add TestSecurityConfig for enhanced test security configuration.
…remental update failures. Update related services and DTOs to support new functionality. Enhance VCS integration with additional event handling.
…f user-based connection.
…er's getDescriptor method
…iguration for integration tests
…dling; add settings page and secure auth token generation
|
| Severity | Count | |
|---|---|---|
| 🔴 High | 1 | Critical issues requiring immediate attention |
Detailed Issues
🔴 High Severity Issues
Id on Platform: 431
File: .../internal/InternalAnalysisController.java:31
Issue: All endpoints under /api/internal/analysis are exposed via WebSecurityConfig (requestMatchers("/api/internal/**").permitAll()) and the controller only checks projectId/analysisId parameters. An unauthenticated client can enumerate IDs and retrieve any project’s code analysis data, leaking sensitive information.
Suggested Fix:
Require the internal shared secret header (e.g., X-Internal-Secret) on every handler and reject requests when it does not match codecrow.internal.api.secret.
Files Affected
- .../internal/InternalAnalysisController.java: 1 issue
Analysis completed on 2025-12-24 17:03:40 | View Full Report | Pull Request
No description provided.