Skip to content
Open
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
<dependency>
<groupId>it.pagopa.pn</groupId>
<artifactId>pn-commons</artifactId>
<version>2.13.0-SPRINGBOOT3</version>
<version>2.14.0-SPRINGBOOT3</version>
</dependency>

<dependency>
Expand Down
1 change: 1 addition & 0 deletions scripts/aws/cfn/microservice.yml
Original file line number Diff line number Diff line change
Expand Up @@ -482,6 +482,7 @@ Resources:
- 'ssm:GetParameters'
Resource:
- !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/radd-experimentation-zip-*'
- !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/AARQrUrlConfigs'
- Effect: Allow
Action:
- 'dynamodb:GetItem'
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
package it.pagopa.pn.deliverypushworkflow.config.springbootcfg;

import com.fasterxml.jackson.databind.ObjectMapper;
import it.pagopa.pn.commons.abstractions.impl.AbstractCachedSsmParameterConsumer;
import it.pagopa.pn.commons.utils.qr.QrUrlCodecService;
import org.springframework.context.annotation.Configuration;

@Configuration
public class QrUrlCodecConsumerActivation extends QrUrlCodecService {
public QrUrlCodecConsumerActivation(AbstractCachedSsmParameterConsumer abstractCachedSsmParameterConsumer, ObjectMapper objectMapper) {
super(abstractCachedSsmParameterConsumer, objectMapper);
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

import it.pagopa.pn.deliverypushworkflow.action.utils.EndWorkflowStatus;
import it.pagopa.pn.commons.exceptions.PnInternalException;
import it.pagopa.pn.commons.utils.qr.QrUrlCodecService;
import it.pagopa.pn.commons.utils.qr.models.UrlData;
import it.pagopa.pn.deliverypushworkflow.config.PnDeliveryPushWorkflowConfigs;
import it.pagopa.pn.deliverypushworkflow.dto.ext.datavault.RecipientTypeInt;
import it.pagopa.pn.deliverypushworkflow.dto.ext.delivery.notification.NotificationInt;
Expand Down Expand Up @@ -42,7 +44,7 @@
private final PnSendModeUtils pnSendModeUtils;
private final TemplatesClient templatesClient;
private final TemplatesClientPec templatesClientPec;

private final QrUrlCodecService qrUrlCodecService;

/**
* Generates the legal fact for the viewing of a notification.
Expand Down Expand Up @@ -401,13 +403,14 @@
*
* @param recipient the {@link NotificationRecipientInt} object representing the recipient of the notification,
* used to retrieve the base access URL.
* @param quickAccessToken the token used to generate the quick access link, typically used for secure access.
* @param quickAccess the token used to generate the quick access link, typically used for secure access.
* @return a {@link String} representing the full quick access URL, including the token as a query parameter.
*/
private String getQuickAccessLink(NotificationRecipientInt recipient, String quickAccessToken) {
String templateUrl = getAccessUrl(recipient) + pnDeliveryPushWorkflowConfigs.getWebapp().getQuickAccessUrlAarDetailSuffix();
log.debug("getQrCodeQuickAccessUrlAarDetail templateUrl {} quickAccessLink {}", templateUrl, quickAccessToken);
return templateUrl + '=' + quickAccessToken;
private String getQuickAccessLink(NotificationRecipientInt recipient, String quickAccess) {
UrlData urlData = new UrlData();
urlData.setRecipientType(it.pagopa.pn.commons.utils.qr.models.RecipientTypeInt.valueOf(recipient.getRecipientType().name()));
log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess);

Check failure

Code scanning / CodeQL

Insertion of sensitive information into log files High

This
potentially sensitive information
is written to a log file.
This
potentially sensitive information
is written to a log file.
This
potentially sensitive information
is written to a log file.

Copilot Autofix

AI 20 days ago

To fix the problem, we should avoid logging the value of quickAccessToken (or quickAccess) directly. Instead, the log statement should be modified to either remove the token entirely or replace it with a generic message that does not expose sensitive data. The log line at 412 should be changed from:

log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess);

to something like:

log.debug("getQrCodeQuickAccessUrlAarDetail called");

This preserves the intent of logging the method invocation for debugging purposes without leaking sensitive information. No additional imports or method changes are required.


Suggested changeset 1
src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java b/src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
--- a/src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
+++ b/src/main/java/it/pagopa/pn/deliverypushworkflow/legalfacts/LegalFactGeneratorTemplates.java
@@ -411,3 +411,3 @@
         urlData.setRecipientType(it.pagopa.pn.commons.utils.qr.models.RecipientTypeInt.valueOf(recipient.getRecipientType().name()));
-        log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess);
+        log.debug("getQrCodeQuickAccessUrlAarDetail called");
         return qrUrlCodecService.encode(quickAccess, urlData);
EOF
@@ -411,3 +411,3 @@
urlData.setRecipientType(it.pagopa.pn.commons.utils.qr.models.RecipientTypeInt.valueOf(recipient.getRecipientType().name()));
log.debug("getQrCodeQuickAccessUrlAarDetail: {}", quickAccess);
log.debug("getQrCodeQuickAccessUrlAarDetail called");
return qrUrlCodecService.encode(quickAccess, urlData);
Copilot is powered by AI and may make mistakes. Always verify output.
return qrUrlCodecService.encode(quickAccess, urlData);
}

/**
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

import com.fasterxml.jackson.databind.ObjectMapper;
import it.pagopa.pn.commons.abstractions.ParameterConsumer;
import it.pagopa.pn.commons.utils.qr.QrUrlCodecService;
import it.pagopa.pn.deliverypushworkflow.action.it.mockbean.*;
import it.pagopa.pn.deliverypushworkflow.action.utils.InstantNowSupplier;
import it.pagopa.pn.deliverypushworkflow.config.PnDeliveryPushWorkflowConfigs;
Expand Down Expand Up @@ -32,6 +33,7 @@

import java.util.ArrayList;
import java.util.List;
import java.util.Optional;

public class AbstractWorkflowTestConfiguration {
static final int SEND_FEE = 100;
Expand Down Expand Up @@ -86,7 +88,7 @@ public InstantNowSupplier instantNowSupplierTest() {
public LegalFactGenerator legalFactGeneratorTemplatesClient(@Lazy PnSendModeUtils pnSendModeUtils, PnDeliveryPushWorkflowConfigs pnDeliveryPushConfigs) {
CustomInstantWriter instantWriter = new CustomInstantWriter();
PhysicalAddressWriter physicalAddressWriter = new PhysicalAddressWriter();
return new LegalFactGeneratorTemplates(instantWriter, physicalAddressWriter, pnDeliveryPushConfigs, pnSendModeUtils, templatesClient(), templatesClientPec());
return new LegalFactGeneratorTemplates(instantWriter, physicalAddressWriter, pnDeliveryPushConfigs, pnSendModeUtils, templatesClient(), templatesClientPec(), qrUrlCodecService());
}

@Bean
Expand All @@ -99,6 +101,14 @@ public TemplatesClientPec templatesClientPec() {
return new TemplatesClientMockPec();
}

@Bean
public QrUrlCodecService qrUrlCodecService() {
ParameterConsumer parameterConsumer = Mockito.mock(ParameterConsumer.class);
ObjectMapper objectMapper = Mockito.mock(ObjectMapper.class);
Mockito.when(parameterConsumer.getParameterValue(Mockito.any(), Mockito.any())).thenReturn(Optional.of("https://example.com/qr-code"));//to use new common method
return new QrUrlCodecService(parameterConsumer, objectMapper);
}

@Bean
public SaveLegalFactsServiceImpl LegalFactsTest(SafeStorageService safeStorageService,
LegalFactGenerator pdfUtils) {
Expand Down