From 196beb8355d310c24bd7ffb82033b63c203109b6 Mon Sep 17 00:00:00 2001
From: Joel Biddle <joel.sven.biddle@gmail.com>
Date: Tue, 22 Aug 2023 17:50:43 +1000
Subject: [PATCH] removed logs & added pwndpasswords.com api to CSP

---
 backend/src/index.ts                          | 48 ++++++++++++++-----
 .../checks/checkIsPasswordBreached.ts         | 10 ----
 2 files changed, 35 insertions(+), 23 deletions(-)

diff --git a/backend/src/index.ts b/backend/src/index.ts
index 17c030fed..d48a5b97b 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -24,7 +24,7 @@ import {
   secretSnapshot as eeSecretSnapshotRouter,
   users as eeUsersRouter,
   workspace as eeWorkspaceRouter,
-  secretScanning as v1SecretScanningRouter,
+  secretScanning as v1SecretScanningRouter
 } from "./ee/routes/v1";
 import {
   auth as v1AuthRouter,
@@ -58,7 +58,7 @@ import {
   signup as v2SignupRouter,
   tags as v2TagsRouter,
   users as v2UsersRouter,
-  workspace as v2WorkspaceRouter,
+  workspace as v2WorkspaceRouter
 } from "./routes/v2";
 import {
   auth as v3AuthRouter,
@@ -70,14 +70,21 @@ import { healthCheck } from "./routes/status";
 import { getLogger } from "./utils/logger";
 import { RouteNotFoundError } from "./utils/errors";
 import { requestErrorHandler } from "./middleware/requestErrorHandler";
-import { getNodeEnv, getPort, getSecretScanningGitAppId, getSecretScanningPrivateKey, getSecretScanningWebhookProxy, getSecretScanningWebhookSecret, getSiteURL } from "./config";
+import {
+  getNodeEnv,
+  getPort,
+  getSecretScanningGitAppId,
+  getSecretScanningPrivateKey,
+  getSecretScanningWebhookProxy,
+  getSecretScanningWebhookSecret,
+  getSiteURL
+} from "./config";
 import { setup } from "./utils/setup";
 import { syncSecretsToThirdPartyServices } from "./queues/integrations/syncSecretsToThirdPartyServices";
 import { githubPushEventSecretScan } from "./queues/secret-scanning/githubScanPushEvent";
-const SmeeClient = require('smee-client') // eslint-disable-line
+const SmeeClient = require("smee-client"); // eslint-disable-line
 
 const main = async () => {
-
   await setup();
 
   await EELicenseService.initGlobalFeatureSet();
@@ -94,11 +101,15 @@ const main = async () => {
     })
   );
 
-  if (await getSecretScanningGitAppId() && await getSecretScanningWebhookSecret() && await getSecretScanningPrivateKey()) {
+  if (
+    (await getSecretScanningGitAppId()) &&
+    (await getSecretScanningWebhookSecret()) &&
+    (await getSecretScanningPrivateKey())
+  ) {
     const probot = new Probot({
       appId: await getSecretScanningGitAppId(),
       privateKey: await getSecretScanningPrivateKey(),
-      secret: await getSecretScanningWebhookSecret(),
+      secret: await getSecretScanningWebhookSecret()
     });
 
     if ((await getNodeEnv()) != "production") {
@@ -106,12 +117,14 @@ const main = async () => {
         source: await getSecretScanningWebhookProxy(),
         target: "http://backend:4000/ss-webhook",
         logger: console
-      })
+      });
 
-      smee.start()
+      smee.start();
     }
 
-    app.use(createNodeMiddleware(GithubSecretScanningService, { probot, webhooksPath: "/ss-webhook" })); // secret scanning webhook
+    app.use(
+      createNodeMiddleware(GithubSecretScanningService, { probot, webhooksPath: "/ss-webhook" })
+    ); // secret scanning webhook
   }
 
   if ((await getNodeEnv()) === "production") {
@@ -119,7 +132,16 @@ const main = async () => {
     // in production
     app.disable("x-powered-by");
     app.use(apiLimiter);
-    app.use(helmet());
+    app.use(
+      helmet.contentSecurityPolicy({
+        useDefaults: true,
+        directives: {
+          defaultSrc: ["'self'"],
+          imgSrc: ["*", "data:"],
+          connectSrc: ["'self'", "https://api.pwnedpasswords.com/range/"]
+        }
+      })
+    );
   }
 
   app.use((req, res, next) => {
@@ -207,8 +229,8 @@ const main = async () => {
 
   server.on("close", async () => {
     await DatabaseService.closeDatabase();
-    syncSecretsToThirdPartyServices.close()
-    githubPushEventSecretScan.close()
+    syncSecretsToThirdPartyServices.close();
+    githubPushEventSecretScan.close();
   });
 
   return server;
diff --git a/frontend/src/components/utilities/checks/checkIsPasswordBreached.ts b/frontend/src/components/utilities/checks/checkIsPasswordBreached.ts
index b9d93b55c..623b43413 100644
--- a/frontend/src/components/utilities/checks/checkIsPasswordBreached.ts
+++ b/frontend/src/components/utilities/checks/checkIsPasswordBreached.ts
@@ -1,28 +1,18 @@
 import axios from "axios";
 import crypto from "crypto"; // added types from @types/node
 
-///// REMINDER: ensure all logs are deleted!!! /////
-
 export const checkIsPasswordBreached = async (password: string) => {
   const dataBreachCheckAPIBaseURL = "https://api.pwnedpasswords.com/range/";
   try {
-    console.log("password:", password); // delete later!!!
-
     const textEncoder = new TextEncoder();
-
     const encodedPwd = textEncoder.encode(password);
-    console.log("encodedPwd:", encodedPwd); // delete later!!!
-
     const hash = crypto.createHash("sha1").update(encodedPwd).digest();
-    console.log("hash:", hash); // delete later!!!
 
     const hashedPwd = Array.from(new Uint8Array(hash))
       .map((byte) => byte.toString(16).padStart(2, "0"))
       .join("")
       .toUpperCase();
 
-    console.log("hashedPwd:", hashedPwd); // delete later!!!
-
     const response = await axios.get(`${dataBreachCheckAPIBaseURL}${hashedPwd.slice(0, 5)}`);
     console.log("response:", response); // delete later!!!