From 6b6d6effecbc88726d6b73f1aecf5beb68bc6012 Mon Sep 17 00:00:00 2001 From: lachlan-robinson Date: Thu, 1 May 2025 10:24:28 +1000 Subject: [PATCH] chore: exposed sourcemap review --- .../exposed-sourcemap-review.md | 67 ++++++++++++++++++ .../Security Analysis/img/exposedmaptest.jpg | Bin 0 -> 11937 bytes 2 files changed, 67 insertions(+) create mode 100644 docs/OnTrack/Security Analysis/exposed-sourcemap-review.md create mode 100644 docs/OnTrack/Security Analysis/img/exposedmaptest.jpg diff --git a/docs/OnTrack/Security Analysis/exposed-sourcemap-review.md b/docs/OnTrack/Security Analysis/exposed-sourcemap-review.md new file mode 100644 index 000000000..865eef965 --- /dev/null +++ b/docs/OnTrack/Security Analysis/exposed-sourcemap-review.md @@ -0,0 +1,67 @@ +# Exposed JavaScript Source Map Review + +_Lachlan Robinson (220325142)_ + +## Summary of Finding + +The audit conducted by AppAttack identified that the main.js.map file was accessible to +unauthenticated users at http://172.18.0.1:4200/main.js.map. As noted, source maps expose original +source code structures and may lead to reverse engineering or disclosure of sensitive implementation +details. + +## Assessment and Remediation Status + +We acknowledge this as a valid concern and appreciate the identification. However, it is important +to clarify that: + +- The main.js.map file is only present in development builds of the application. + +``` +"development": { + "optimization": false, + "extractLicenses": false, + "sourceMap": true + } +``` + +- In our deployment process, production builds are created using the Angular CLI with the + --configuration production flag, which disables the generation and exposure of source maps by + default. + +``` +"production": { + "budgets": [ + { + "type": "anyComponentStyle", + "maximumWarning": "6kb" + } + ], + "fileReplacements": [ + { + "replace": "src/environments/environment.ts", + "with": "src/environments/environment.prod.ts" + }, + { + "replace": "src/app/config/constants/apiURL.ts", + "with": "src/app/config/constants/apiURL.prod.ts" + } + ], + "optimization": true, + "outputHashing": "bundles", + "sourceMap": false, + "extractLicenses": true, + "serviceWorker": "ngsw-config.json" + }, +``` + +- Therefore, in production environments, this file is not present, and the application does not + expose source maps publicly. + + ![](./img/exposedmaptest.jpg) + +## Recommendation for Retesting + +For future vulnerability assessments, we recommend that penetration testing be performed against a +production-equivalent build of the front-end application. This ensures the test environment mirrors +the real-world deployment configuration and avoids false positives related to development-only +artifacts. diff --git a/docs/OnTrack/Security Analysis/img/exposedmaptest.jpg b/docs/OnTrack/Security Analysis/img/exposedmaptest.jpg new file mode 100644 index 0000000000000000000000000000000000000000..226bb15680aac4f2fa6b8d4dcb0fb141be0aaf61 GIT binary patch literal 11937 zcmeHtcUV)ww(mxI5u|re0YMOv-ie5SfQX=g(xRYrh&1U0L3)!eBA^s$0#X7>6$rg| z2|WR%lh6zhk{i#x?_AG$_uhBz`{TXue&3nw^~au>wPyX+UYS|5W(YqBi@*h4Egda@ zgoFfmLi_=Q89)OdJ$LT+Lo8&(hn$L>oQ#Z|hLVzkijIbkj+Ta&_B=h)h4b``^t7}W z*e)M<5f-^BDkCc=ub`-; zaa&VM`;Lz8gNMc@rjH(***tr0YiIA^=;7)0(%Z+^FZ6X-ctm7WbW(CkYFhf+jCZ+t z`30W}i;7FCs%v1ibzi^Lx3$ANI=i}idPm2`Cnl$UOe2<%sO6Q_pKI$In7#dj!=qo= zNrQ1pzQe9LLlLx8yoRRzSxaCWJb}PDV7@YT^;+EvMRb7ihS^_{d zSU>>O7LFOAouyU|-Y-d|zjwFHZ-6ANV)T<_-pR#l(#PI-cpz(0lwdz3nOnAzX5D^2 zo20kY?LZ}ActW@The(A6TB5B1#JVnRxxpt8dNV^KCHGf!i`og zJv7wx(XM4N)CB%J#OgStSKq=JLXqeZH%GZ@Ke~lqC{ia;pr1tzyF=BjqF8k3oOm1= zS)Pb&n{v!X>7^_|mpI2;e$Ehp%M#d;zcETvp&r($ctg^xrcO@DIo;<}w&~zh=q+E^ z{c|q@H@V?fT;l;^Mck^ov#rZ-z?1YI#W<9}$4=7`*Jfp|&Xf%NI~|>;`y$n*b!Tk(6%Fx zCPm6`tO8ZKC#2>5(vDw~#l-egVK{VI(S-nWK_e6iO-9~Cin1wVgBvkC`-hj-7rbRin|I^t^8AR<|( zcq84tfJ^bKg20FD&=2{adM;~ltHd(0JgZz2O{zRUyA+^L050|AU>WcsV%N(y(nAQq z{cN|kYPSO(hGApfjvY_&gyDtP;%M&&X!fv7cvpMcyQVEh4ZrGw`W|P`(_&#eXB5Q- zGtcchiP(UNz0MpI$ysrEZ!IIddZDIG0ZUyi;T&0?^n#c_#1cayj>1VOr{I=)HE2=rpn0m zQXL8=U^9V%L3>=M0!CQ7%lN@Q^n~?De1%J{aNIe$3g>s}M<4sEX1IY>)Qhp4dYc>Z zl!lll7igOcQUa^P4F}I43UPvTI!bjjf~ST;a?GncbG=DTer}^JHynRX3)^fw!ZWTl zGoyz(4M=>T22(JD3+86nptjYc)eVkq7|%z7Ecy8bE+%a z&m=6+eXyOXdhu?I)JDux=uwYhO)1HX+foBI_Mh*DB?fD2R7bhrTcA!yPQ?q4h6p=Yhq)JUS6h2;y>J#z|MAwW_bD^5vi>U6lN1;%Fbkn#Z4o zJDl5$*jgKsQG2*o+@H8ev_u>1U3;(|r*`{oKk8t1&lLEfex_ zI;R)c`6$o>s|96F?mccxUu8KP^_+NT4V6MhyYi1oZMNANxRM)_qX5HfF^K-z8ytHe zC_=pA`eC5heHWiKzm>S!qV!z{k+Dw=&zQJ51egSFe<+dZ2|qpCT*=btvJ#wVfvL?Q zc}@0DAKsE>sIlr3o*}zPb^9A+-WhP2%lgXE;RFt_$A%WeG8!=pQRM@fkXq@DUkuAP zv~E6-*vpFF?6P}0{O;Om*p!V2vg?(KY%W&2l}`*^cvM!Kj#Suv_+yiu(PD@$ZHhv5 z-r23Qz*3jDK`Q^o>@3%>AyS`{uJ8OLc$WFiW(g+{J+CtSs@EbqT`JBu+rcJ|OV;3G zksYOHISopbnsuK)9Dnirl{V$`b~nFZ(sEoGemEcYHDJz%uZmv^bJ=-H+xW&@vFE{#j-KaRH%fX>EyBiogk; z{CX{?7Tbcz=8oxaygQ_T$Qud`9mb>GejHRVjs`q-bGVYqR_K~7IC3y1X1-Qm(9!i{ zs-Itt%&4;`4bf$DT{m{w&5{Z`P-gG#0(ymlgj+e1)hD!>eaZtGT7~X@GSA>h?dhcA z$rhDRbyp zWmL^^ZR+R|T0UCEp&09}k<+2ZAIRN#0qeTD4`)&r-C(Tos18hJVu7Q&yR~e|1x>mK z5olF0lyJ-z?x`J;dzWd`uWVNRVph4VVr;rx?o%;y~iFDUZWO*0cGsI_OfknQB7R z^<{&UIItI-REjqh=(I1hvI=s_1qCGV_E_wJSlPBA|kpy7LoL6_#%r41BcxQTJ3!Uo*D4?aK&|$TulTdx z5}0~+)6C>cIVL8w$ZR&!IZub|k@464?SxsE24O|i3ZfDFV2J>{VpHNzaIVqYhQQVM zr^0hS`#2n`2YtD7P3YU346Pg{!8gwHy1r`-9u2WM8Lo{ENZL(HBg9Y3@p5sPc~0%d zg+5;ap_NXZ{ZC{_?LOvjRqh5VlN|)06B5al_d|6zK0wb05m2m}Y2o;b-X;HjZv`KC z`3YyR02zf^&0jo337v^8)lKf=s*Coj;PP=4SLrM0^Nl=oVBV&Xi(Z=5dBqaDa6{@U z$4s4&X}1@zvO$FYmj;+#5n_KpwCZlfN=YTabiq|H@G7MFl275oNdiy{QPKNsxq&xL zKKrPOt8iN(03Q9~4G`g2WEDhKZ{U`J)W(i~hSWg41LvSlkD~CmO?{?b*bcaA>IVU+ zX?#F5qxO+0P7Ja|0IF*SoVD@t}gplFeNX!M-EHl0~Ztn`TD!aDknuVOw#OKb?;c=!FK-k z278=Xay2%wSo2e>jla{=&#e%A-l;Bw3|umnG_h++Hl`dKatcomSv|4bDy@<+rb#SX zE6EEMF$~ncTKbq*;`{EgIGBL|Y&{(#00*Cx4nT|sAF%r!e9|o#`RGO`IIw<;NetzUtLsE+&8c z$errq1?`K`vs2B2K6M>;ddhqX%_bRhZ?LwEUwO~bmmfxd1iI>ja`xf5JKBadb}#m5!JJMaH9ZUL*n3-@T2RNw+2XtZG^g`udtQXqu?Rt(lDemk%~JJ)lmVGpx% zoS)p{N+EB@flL?M;pwZ4(_}Hu2xBq4N&a6^pg39s&&Yr^Rf6EeCAOejkZn2Q7R0H4 z2%&<*pKkMk2aZ%{$*U@8`|k3&9c{%ju94e411}XoSRI(e@iB4N5 z!jb*b3%{#=Omkp%b*~vojAA5mn{Gv0gdSyUr;k{D)Z}@!t@5vRilhi%KCq@=7>he) z&7Mkg^dXJNGK0giZy@Uii(xn4SohwE*tkgE8`Z+Zl>^fvL+y+H1_FI+6$W;XrmnSW z7b}!(7tdU6P2VFM>09N&Yri+NiaRTIA^@sT%ov^p>S#s)hQK&a0uaX2Y_l4epqSgl zeQGp?_agwPLYxSG97X`LTd?Z{fJQN(J>y7aHTnRutp`5dBmnU_=)6DruI$s>{n&pe zHqrtUhyJXHm{nw9Pn{*TrF`Z%qqqy>@IvOh%tctK0r ze~5TdEpGT9!^mB-HOnm_0DpWk{(qOD+13x!H2xFUzneBD?EeG8;;PPSEzH;1Sh>V4 z$Cf`3{$V6b@{BIWZ2oU!tICX@UgxBaKRaV+VkIsre_&+I5tUsHj3K64?5$Z$$G_nF z>VJmd*#t|MoS>}OA$VHDn?5g^8T;C@5MJ*)&ClCkK25#J07jxAytr!^?RL-?0??*Y zKmcsd>iSPXC%27ur|Z0DZ9C;FEWC=146J7@ycLy1a*KjWwmE#}U{NaPyTW34_f2l} z2`$`gDk6vuTQ&BbEr=UEH(e`-amp6NTzNmWCo_6krazKevV(7nJeFOVde+-I`Q=ry z9JLXv{Zm~%^q|3ctQekk++?vw2#1KBtd+meY1ur;%Jdkiog^!EWkRUdRUlZ?N0!ms zl=`~qlicV7;(VvZj6UlOMM5}z(grup#&D`a?% z&~g5Uj^&Si8nJZ-hW-U!*tT-(ydpX!h;v+)TCL}U(>s$CakbVka+i5fiar%>Fh{y2 zJX}?5^@RB=qW0t6?B{h+`K~brp9kD;2}CJN3hxns!!c{Ks*=wqHSnJ_AfeKjj~#Ux zJUPxZTWS}uJU*wLcuw?i&Q@{Bye3&4@T@bo-T&2WSPxEYf*2t>6H^+`vF|q9toTM{ zTBz2~lihGgwm0#Pk&zG+h0X4VN-NWE7+kygL-agDri4r#%yPrKYhm12^k^vNgg&Jb z3xS^qrTAH;BjZ#n=rg#}^zxs0J5|6Hu^d$ zGz!aNHXW7~GcO&&-YHvsr_BARERvl9Dkqo*k`TEgx$-)u?xmYyfBD!N;xyCrU}SUI z^zdY6$}&MLw~2mX>3Wt&5tTMPfl??_lew!%Whz(RS1^$*2s|CI@^mGsBafz}TQ6WU z#~KShRbH#Ka5#~Vm5JOre5-a@I6}foxj0dv zi=0MAGbb~+srl%4%P#VD>(ITRG;fvc=wA#G1fZG#LJ2_bghbzO0upc0a%onph3W9@C?U%rkZ~Ero|R|obtCgNKMQ3j|y0LZOk@vcN}?czO&m( zmFLruEBLD>+9zsMjwiw?I(JUV#Vu-f<|xK zPSh5YGPiHY4q_(Jo$7qJe(%d{`+DMfU!JoX(Mtd-a*n0n<~BUT`g#|eOx@_lu-b>kEP6|3~@HSXdDf1m*F?2fL z@H=u1sk?%qdwD|R@XlG>v0B7w`t7P-IDSX_Hg7scHbRq>MkMzYxxe^NxI_e)N!+;t z=U?a(-Pd7)(S~>wVZA>1916x6v##jenZ7>J`n+4Ahc_b5P^UB{D}Dj#4JSt2vkqoK zai4hE+fH~ZYeu&O(+5(nTJPzJExIOY3&jJZ7fD_v!wofMKV*J2tqnMb5q`a;B7|%b zfX@p@v`bk!`l+7PBtN#Wh%!OwAT-Z<2;<&TPkPg?Tw_ujXp~;kQp=8JkKHVsr}XVZa%fl!Tqz+r*t>oe!5-`N-etl&~dlX zrcWsN0v)VR)e)%*u|lVCEybgZ(c9&TtVo%n(>8MpnO;MAHh~w57wFxF2J5&yCzE{B zRx}=AHcd>S+~;)7uOTSZKQvYgYub z;i%`Cu;GZ82p75&vR(djKhuWntnVXj`0=p?3igk3t&i79?3np7RxC&oUv`LyM%ddS#Lrw`;_jl+PZ_o)GJt-*R^K%HKn*3B-eN~H_|{l| z_`OK$klFroY$QUpVH)dwuWn3c9TjOg1JUm@oY(0&G$=xuj6{#L>#iE;L8PI&41T9Bi=y_FRdvhj=bmeDg7pvxVV<+O~Fq{Ags@eGy088jVc3!DZ z^*wZR-iMjp`o@Ma8J{w2*=R)$W>)OC?P`5oU6Sj=PURlyH2olzepLLp^apqj%0kY?1=ukmLAk8N@`_%KT%zO*Z3cFHr!r#a#G`;lfaK2AOI``U@ZqrjJ3%3pke=e zO;G!Yc3oiT#>h^P3bb7wM@-7)LXrG9_8#Ic|8L(}PZ>0cdN7n~f5T!30Nnz{03SsF zBB5xoFxK$zD@?akS^T|!{8Q=wW&3|x`cHrPr+fU}U-O^t@juQzh!gX_&9z}HroAoa zo?*>}<7Fu^i|G1*0AhwE{lVEnWd5teaf2GYBXzr%y_)s=obZ%Oi zA1+O;q~^O-pV`Ue9@knDZzar34hNY#GSx@~#V^E~;^z~p)+&-4H8EnH(DR29%ve)% zY=Y;BWqfgN*>3!yxLT*;L5y;@om4FodF^dx^UfH-k*@|dNh@v9t7?}vi3wqN&h%6V zS32%m+yf(YON7evC(Z#+pF;}CCl0zRu02oNF+IH+mNcp15%uKG@LBqG9?IEYt}|lb z-Ds${?1^(1B>W7zNC48811mM%p|oE5%8$@$S>6RcC_I~NY`B30JUj6Hf)hNJVaSf> z1@CK?;|qaLA%hhI4K39@!D%b2h z66(*FQ|=RPe&>L@=Q6uwM}EhPF9`XxS=JOi)lLP4`c8Eqw&55Go=UQ90#$56I=jYM z4IWKiQvnrNZuk{!H)npDhL6q8Tj^G6kU2^X?!d|KlL#gUlLvqb@WXfzIy(Ush0{S< zYM9r-Dx1Q4ms~tIDXY?WgDj=QGK5dXI%8laI{7}?GRA_Mom@V6xdm+Aku|n^UJ9F$ z53iSpd;N~QK$4!>gBn^+l4o^G$KdkCfrQhj6= zz=?&FVShb(Kc#d+_A7B2QHP@K!I90d@?Q+ZV5ae}2NuR8kY6 z;D2Ok@g7RmGCpdxy>Pn%TfOcmHiXm1*xlCK<-&q>C)`ltq#8;!M>%%TS?$X@%RNoW zea2VdkyeyZHmtRyFpsLYyyuu$m|_Rn``m zw`r#}QWIxtfFbisO{;dX6a3|_tzx7PDg4paYRK$PZk+*YA`8yZ!Vlu5nlL7LD5{H? z%>Y9*?0s#^bhGH*){&kxTz{ZS$ARTVZ)Iv+ooEtW2WQkhSvLpRG#FDyOqc-!I-pHr z{wZ1YQ?y92h)8ZU@c)9s_XZb?sk>ee>P5t;MnJ zi!fM-veP3*>u8Sqm$jmAl$0nCuOX9;e##9dCUpKn3jAyV0tVbZ4SEwWD9dIYmt3Yd z#Yf7psja9&?zi{W3T(~YUUYz+Gw+_ti>}<^C_jl7F%y#jZ=#O{>nV1A=cOp+G0fl7 z_?cDsp~T6{>FqTLovn^Ir-@;e=9?!~Up7KjJO?~e{tu_4|JBLq|A01r!t}oY`_HNK literal 0 HcmV?d00001