PN-15946 - common version update + getQuickAccessLink implemented new… #28
Conversation
… qr generation + ecs policy added parameter
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
Fixed
Show fixed
Hide fixed
src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
Fixed
Show fixed
Hide fixed
src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
Fixed
Show fixed
Hide fixed
…ion in appropriate package
src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
Fixed
Show fixed
Hide fixed
| private String getQuickAccessLink(NotificationRecipientInt recipient, String quickAccess) { | ||
| UrlData urlData = new UrlData(); | ||
| urlData.setRecipientType(it.pagopa.pn.commons.utils.qr.models.RecipientTypeInt.valueOf(recipient.getRecipientType().name())); | ||
| log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess); |
Check failure
Code scanning / CodeQL
Insertion of sensitive information into log files High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 20 days ago
To fix the problem, we should avoid logging the value of quickAccessToken (or quickAccess) directly. Instead, the log statement should be modified to either remove the token entirely or replace it with a generic message that does not expose sensitive data. The log line at 412 should be changed from:
log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess);to something like:
log.debug("getQrCodeQuickAccessUrlAarDetail called");This preserves the intent of logging the method invocation for debugging purposes without leaking sensitive information. No additional imports or method changes are required.
| @@ -411,3 +411,3 @@ | ||
| urlData.setRecipientType(it.pagopa.pn.commons.utils.qr.models.RecipientTypeInt.valueOf(recipient.getRecipientType().name())); | ||
| log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess); | ||
| log.debug("getQrCodeQuickAccessUrlAarDetail called"); | ||
| return qrUrlCodecService.encode(quickAccess, urlData); |
|
… qr generation + ecs policy added parameter