From 03f4bc4c1211c6969394607e3985ebb6724843d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dafydd=20Ll=C5=B7r=20Pearson?= Date: Wed, 14 Feb 2024 11:45:29 +0000 Subject: [PATCH 1/8] docs: Add link to pen test report in repo readme (#2789) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f6d9930baa..f7523d8075 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ Our public-facing live services were last audited by the [Digital Accessibility ### Security -Our whole stack was last assessed by [Jumpsec](https://www.jumpsec.com/) between the 21st and 30th November 2023. JUMPSEC then performed a retest of the issues identified in the initial test on the 8th of February 2024. This included verifying that fixes had been successfully applied and that no further risks were introduced as a result of the remediation work carried out. Their penetration test concluded that - "the security posture of PlanX was strong, and following industry best practices. JUMPSEC commend the PlanX team on their dedication to security and ability to both maintain and mitigate issues in a responsible and timely manner". +Our whole stack was last assessed by [Jumpsec](https://www.jumpsec.com/) between the 21st and 30th November 2023. JUMPSEC then performed a retest of the issues identified in the initial test on the 8th of February 2024. This included verifying that fixes had been successfully applied and that no further risks were introduced as a result of the remediation work carried out. Their penetration test concluded that - "the security posture of PlanX was strong, and following industry best practices. JUMPSEC commend the PlanX team on their dedication to security and ability to both maintain and mitigate issues in a responsible and timely manner". You can [review our report here](https://file.notion.so/f/f/d2306134-7ae0-417c-8db3-cdd87c524efa/ab940248-ca60-49a3-bfae-0b6faa916b1e/2024-02-13_JUMPSEC_Lambeth_PlanX_Web_Application_Assessment_Report_v2.0.pdf?id=aa4ed144-4b48-4a88-9693-6a3644bfd6cf&table=block&spaceId=d2306134-7ae0-417c-8db3-cdd87c524efa&expirationTimestamp=1707998400000&signature=76AfnXjSTzw8O5TEW9Ao0mOmWTG4WzE8rm-Rfa54wGU&downloadName=Penetration+test+%28Jumpsec%29+13%2F02%2F24.pdf). ## Related packages From 7757af511e144089d70b025b0cd43a033d1e8e45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dafydd=20Ll=C5=B7r=20Pearson?= Date: Wed, 14 Feb 2024 14:15:37 +0000 Subject: [PATCH 2/8] chore: Sync govpay secrets (#2787) --- scripts/seed-database/container.sh | 2 +- scripts/seed-database/write/team_integrations.sql | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/scripts/seed-database/container.sh b/scripts/seed-database/container.sh index c3f3152738..e6e56cd635 100755 --- a/scripts/seed-database/container.sh +++ b/scripts/seed-database/container.sh @@ -35,7 +35,7 @@ done # Copy subset of team_integrations columns # Do not copy production values -psql --quiet ${REMOTE_PG} --command="\\copy (SELECT id, team_id, staging_bops_submission_url, staging_bops_secret, has_planning_data FROM team_integrations) TO '/tmp/team_integrations.csv' (FORMAT csv, DELIMITER ';');" +psql --quiet ${REMOTE_PG} --command="\\copy (SELECT id, team_id, staging_bops_submission_url, staging_bops_secret, has_planning_data, staging_govpay_secret FROM team_integrations) TO '/tmp/team_integrations.csv' (FORMAT csv, DELIMITER ';');" echo team_integrations downloaded psql --quiet ${REMOTE_PG} --command="\\copy (SELECT DISTINCT ON (flow_id) id, data, flow_id, summary, publisher_id, created_at FROM published_flows ORDER BY flow_id, created_at DESC) TO '/tmp/published_flows.csv' (FORMAT csv, DELIMITER ';');" diff --git a/scripts/seed-database/write/team_integrations.sql b/scripts/seed-database/write/team_integrations.sql index 44a433e756..9eda3c21a5 100644 --- a/scripts/seed-database/write/team_integrations.sql +++ b/scripts/seed-database/write/team_integrations.sql @@ -4,19 +4,21 @@ CREATE TEMPORARY TABLE sync_team_integrations ( team_id integer, staging_bops_submission_url text, staging_bops_secret text, - has_planning_data boolean + has_planning_data boolean, + staging_govpay_secret text ); \COPY sync_team_integrations FROM '/tmp/team_integrations.csv' WITH (FORMAT csv, DELIMITER ';'); INSERT INTO - team_integrations (id, team_id, staging_bops_submission_url, staging_bops_secret, has_planning_data) + team_integrations (id, team_id, staging_bops_submission_url, staging_bops_secret, has_planning_data, staging_govpay_secret) SELECT id, team_id, staging_bops_submission_url, staging_bops_secret, - has_planning_data + has_planning_data, + staging_govpay_secret FROM sync_team_integrations ON CONFLICT (id) DO UPDATE @@ -24,7 +26,8 @@ SET team_id = EXCLUDED.team_id, staging_bops_submission_url = EXCLUDED.staging_bops_submission_url, staging_bops_secret = EXCLUDED.staging_bops_secret, - has_planning_data = EXCLUDED.has_planning_data; + has_planning_data = EXCLUDED.has_planning_data, + staging_govpay_secret = EXCLUDED.staging_govpay_secret; SELECT setval('team_integrations_id_seq', max(id)) FROM From dccadc0b3992e723a34320f19058c9ebc96ee0f2 Mon Sep 17 00:00:00 2001 From: Jessica McInchak Date: Thu, 15 Feb 2024 09:31:12 +0000 Subject: [PATCH 3/8] fix: format Airbrake API errors for more readable Slack (#2781) --- api.planx.uk/server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api.planx.uk/server.ts b/api.planx.uk/server.ts index 649e615984..b2842216f0 100644 --- a/api.planx.uk/server.ts +++ b/api.planx.uk/server.ts @@ -157,7 +157,7 @@ const errorHandler: ErrorRequestHandler = (errorObject, _req, res, _next) => { airbrake && (errorObject instanceof Error || errorObject instanceof ServerError) ) { - airbrake.notify(errorObject); + airbrake.notify(JSON.stringify(errorObject, null, 2)); return { ...errorObject, message: errorObject.message.concat(", this error has been logged"), From 59ec67941e9d7a678abf4d2660d2026b385b8f47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dafydd=20Ll=C5=B7r=20Pearson?= Date: Thu, 15 Feb 2024 11:12:45 +0000 Subject: [PATCH 4/8] fix: Add no-cache headers to file route (#2793) --- api.planx.uk/modules/auth/middleware.ts | 10 ++++++++++ api.planx.uk/modules/file/routes.ts | 7 ++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/api.planx.uk/modules/auth/middleware.ts b/api.planx.uk/modules/auth/middleware.ts index bf0f412e13..b1695d5fe1 100644 --- a/api.planx.uk/modules/auth/middleware.ts +++ b/api.planx.uk/modules/auth/middleware.ts @@ -207,3 +207,13 @@ export const useLoginAuth: RequestHandler = (req, res, next) => }); } }); + +export const useNoCache: RequestHandler = (_req, res, next) => { + res.setHeader("Surrogate-Control", "no-store"); + res.setHeader( + "Cache-Control", + "no-store, no-cache, must-revalidate, proxy-revalidate", + ); + res.setHeader("Expires", "0"); + next(); +}; diff --git a/api.planx.uk/modules/file/routes.ts b/api.planx.uk/modules/file/routes.ts index 5603d962f7..9f301b4ea2 100644 --- a/api.planx.uk/modules/file/routes.ts +++ b/api.planx.uk/modules/file/routes.ts @@ -1,7 +1,11 @@ import { Router } from "express"; import multer from "multer"; -import { useFilePermission, useTeamEditorAuth } from "../auth/middleware"; +import { + useNoCache, + useFilePermission, + useTeamEditorAuth, +} from "../auth/middleware"; import { downloadFileSchema, privateDownloadController, @@ -37,6 +41,7 @@ router.get( router.get( "/file/private/:fileKey/:fileName", + useNoCache, useFilePermission, validate(downloadFileSchema), privateDownloadController, From 6b625b0e823bec1830a0666ea9204c998dd5059f Mon Sep 17 00:00:00 2001 From: Jessica McInchak Date: Thu, 15 Feb 2024 11:17:12 +0000 Subject: [PATCH 5/8] Revert "fix: format Airbrake API errors for more readable Slack" (#2794) --- api.planx.uk/server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api.planx.uk/server.ts b/api.planx.uk/server.ts index b2842216f0..649e615984 100644 --- a/api.planx.uk/server.ts +++ b/api.planx.uk/server.ts @@ -157,7 +157,7 @@ const errorHandler: ErrorRequestHandler = (errorObject, _req, res, _next) => { airbrake && (errorObject instanceof Error || errorObject instanceof ServerError) ) { - airbrake.notify(JSON.stringify(errorObject, null, 2)); + airbrake.notify(errorObject); return { ...errorObject, message: errorObject.message.concat(", this error has been logged"), From 35190d9923f3212f515ab10bc2aa006598b80db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dafydd=20Ll=C5=B7r=20Pearson?= Date: Thu, 15 Feb 2024 11:21:56 +0000 Subject: [PATCH 6/8] fix: Typo in `PropertyInformation` component [skip pizza] (#2795) --- .../src/@planx/components/PropertyInformation/Editor.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/editor.planx.uk/src/@planx/components/PropertyInformation/Editor.tsx b/editor.planx.uk/src/@planx/components/PropertyInformation/Editor.tsx index e35fe88c36..98c5a24d45 100644 --- a/editor.planx.uk/src/@planx/components/PropertyInformation/Editor.tsx +++ b/editor.planx.uk/src/@planx/components/PropertyInformation/Editor.tsx @@ -35,7 +35,7 @@ function PropertyInformationComponent(props: Props) {