194580 - productversions integration with scs stub #418

chaital14503 · 2025-01-08T14:55:46Z

This PR includes code changes and UTs for
PBI 194580

…#194580 AB#196244

…rsions-integration-with-scs-stub

…#196244

…on-with-scs-stub

…rsions-integration-with-scs-stub

…on-with-scs-stub

…rsions-integration-with-scs-stub

…s' into dev/194580-productversions-integration-with-scs-stub

ukho-bot · 2025-01-08T14:56:13Z

⛔ Snyk checks have failed. 2 issues have been found so far.

Icon	Severity	Issues
	Critical	0
	High	1
	Medium	0
	Low	1

⛔ code/snyk check is complete. 2 issues have been found. (View Details)

UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs

...SetService.API/UKHO.ExchangeSetService.Common.UnitTests/Helpers/SalesCatalogueClientTests.cs

...ervice.API/UKHO.ExchangeSetService.Common.UnitTests/Helpers/V2/SalesCatalogueServiceTests.cs

ukho-bot · 2025-01-10T14:05:42Z

UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs

                async () =>
                {
-                    var result = await _exchangeSetStandardService.ProcessProductVersionsRequest(productVersionRequest, exchangeSetStandard, callbackUri, _correlationId, GetRequestCancellationToken());
+                    var result = await _exchangeSetStandardService.ProcessProductVersionsRequestAsync(productVersionRequest, ApiVersion.V2, exchangeSetStandard, callbackUri, _correlationId, GetRequestCancellationToken());


Log Forging

Unsanitized input from an HTTP parameter flows into global::Microsoft.Extensions.Logging.ILogger.LogError, where it is used as log input. This may result in a Logs Forging vulnerability.

Line 67 | CWE-117 | Priority score 407 | Learn more about this vulnerability

Data flow: 28 steps

Step 1 - 2

exchange-set-service/UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs

Line 59 in 99d3246

public Task<IActionResult> PostProductVersions(string exchangeSetStandard, [FromBody] IEnumerable<ProductVersionRequest> productVersionRequest, [FromQuery] string callbackUri)

Step 3 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs#L67

Step 4 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L73

Step 5 - 7 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L75

Step 8 - 9 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L82

Step 10 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L92

Step 11 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L73

Step 12 - 14 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L85

Step 15 - 17 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L87

Step 18 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L89

Step 19 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L94

Step 20 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L96

Step 21 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L99

Step 22 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L100

Step 23 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L103

Step 24 - 26 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L122

Step 27 - 28

exchange-set-service/UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs

Line 120 in 99d3246

_logger.LogError(EventIds.SalesCatalogueServiceNonOkResponse.ToEventId(),

ukho-bot · 2025-01-10T14:05:42Z

UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs

                async () =>
                {
-                    var result = await _exchangeSetStandardService.ProcessProductVersionsRequest(productVersionRequest, exchangeSetStandard, callbackUri, _correlationId, GetRequestCancellationToken());
+                    var result = await _exchangeSetStandardService.ProcessProductVersionsRequestAsync(productVersionRequest, ApiVersion.V2, exchangeSetStandard, callbackUri, _correlationId, GetRequestCancellationToken());


Server-Side Request Forgery (SSRF)

Unsanitized input from an HTTP parameter flows into global::System.Net.Http.HttpRequestMessage, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Line 67 | CWE-918 | Priority score 603 | Learn more about this vulnerability

Data flow: 14 steps

Step 1 - 2

exchange-set-service/UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs

Line 59 in 99d3246

public Task<IActionResult> PostProductVersions(string exchangeSetStandard, [FromBody] IEnumerable<ProductVersionRequest> productVersionRequest, [FromQuery] string callbackUri)

Step 3 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/V2/ExchangeSetController.cs#L67

Step 4 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L73

Step 5 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Services/V2/ExchangeSetStandardService.cs#L92

Step 6 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L73

Step 7 - 9 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L81

Step 10 - 11 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/V2/SalesCatalogueService.cs#L87

Step 12 UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/SalesCatalogueClient.cs#L25

Step 13 - 14

exchange-set-service/UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/SalesCatalogueClient.cs

Line 29 in 99d3246

using var httpRequestMessage = new HttpRequestMessage(method, uri)

Nadeem14456

LGTM.

harshal11869

Looks Good.

chaital14503 added 19 commits December 31, 2024 18:50

194580 - initial code changes to call scs productVersions endpoint AB…

8182600

…#194580 AB#196244

194580 - Merged common changes AB#194580 AB#196244

2ddb834

194580 - Merged common changes AB#194580 AB#196244

6776695

194580 - Merged common changes AB#194580 AB#196244

18f7533

194580 - Merged common changes AB#194580 AB#196244

a08ea75

194580 - minor code changes AB#194580 AB#196244

87f861d

Merge branch 'dev/s100-scs-api-integration' into dev/194580-productve…

3b26fde

…rsions-integration-with-scs-stub

194580 - Updated ES and SCS response for 304 NotModified AB#194580 AB…

e3a147a

…#196244

194580 - minor code changes AB#194580 AB#196244

929cea6

Merge branch 'develop-s100' into dev/194580-productversions-integrati…

42536bc

…on-with-scs-stub

194580 - common changes AB#194580 AB#196244

eb7df99

194580 - minor changes AB#194580 AB#196244

323ff06

Merge branch 'dev/s100-scs-api-integration' into dev/194580-productve…

d85a2ef

…rsions-integration-with-scs-stub

Merge branch 'develop-s100' into dev/194580-productversions-integrati…

dd227f8

…on-with-scs-stub

194580 - Added UTs AB#194580 AB#196245

5b9b99e

Merge branch 'develop-s100' into dev/194580-productversions-integrati…

06c7d68

…on-with-scs-stub

194580 - test case renamed AB#194580 AB#196245 UT

9e4c2fd

Merge branch 'dev/s100-scs-api-integration' into dev/194580-productve…

d078a1d

…rsions-integration-with-scs-stub

Merge branch 'dev/195922-Create_stubs_for_S100-SCS-API_productVersion…

593f112

…s' into dev/194580-productversions-integration-with-scs-stub

chaital14503 requested review from harshal11869, Nadeem14456 and shirinbt14926 January 8, 2025 14:55

chaital14503 changed the title ~~Dev/194580 productversions integration with scs stub~~ 194580 - productversions integration with scs stub Jan 8, 2025

ukho-bot reviewed Jan 8, 2025

View reviewed changes

chaital14503 and others added 5 commits January 9, 2025 12:42

194580 - Resolved review comments AB#194580 AB#196244

26358eb

194580 - added Functional Tests and mock data - AB#194580 AB#196210

c5aea92

code refactored

55619ed

194580 - added FT AB#194580 AB#196210

18b4b89

194580 - Merged common changes AB#194580 AB#196244

b88d554

shirinbt14926 and others added 3 commits January 10, 2025 14:59

194580 modify responses AB#194580

0d90bfd

194580 - Updated UTs and code for 400BadRequest AB#194580 AB#196244

7970646

194580 - added cancellationToken AB#194580 AB#196244

c0d883d

harshal11869 requested changes Jan 10, 2025

View reviewed changes

...ervice.API/UKHO.ExchangeSetService.Common.UnitTests/Helpers/V2/SalesCatalogueServiceTests.cs Outdated Show resolved Hide resolved

chaital14503 added 2 commits January 10, 2025 18:29

194580 - BadRequest error format updated AB#194580 AB#196244

aae081c

194580 - review comments fixed AB#194580 AB#196244

99d3246

ukho-bot reviewed Jan 10, 2025

View reviewed changes

Nadeem14456 approved these changes Jan 10, 2025

View reviewed changes

194580 - minor code changesAB#194580 AB#196244

07f26e3

harshal11869 approved these changes Jan 10, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

194580 - productversions integration with scs stub #418

194580 - productversions integration with scs stub #418

chaital14503 commented Jan 8, 2025

ukho-bot commented Jan 8, 2025 •

edited

Loading

ukho-bot Jan 10, 2025

ukho-bot Jan 10, 2025

Nadeem14456 left a comment

harshal11869 left a comment

194580 - productversions integration with scs stub #418

Are you sure you want to change the base?

194580 - productversions integration with scs stub #418

Conversation

chaital14503 commented Jan 8, 2025

ukho-bot commented Jan 8, 2025 • edited Loading

⛔ Snyk checks have failed. 2 issues have been found so far.

ukho-bot Jan 10, 2025

Choose a reason for hiding this comment

Log Forging

Line 67 | CWE-117 | Priority score 407 | Learn more about this vulnerability

ukho-bot Jan 10, 2025

Choose a reason for hiding this comment

Server-Side Request Forgery (SSRF)

Line 67 | CWE-918 | Priority score 603 | Learn more about this vulnerability

Nadeem14456 left a comment

Choose a reason for hiding this comment

harshal11869 left a comment

Choose a reason for hiding this comment

ukho-bot commented Jan 8, 2025 •

edited

Loading