Upgrade the backend and require complete package security scans - #320
Vinosaamaa wants to merge 5 commits into
Conversation
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
7284e01 to
d729300
Compare
|
@CodeAnt-AI: review |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:XL
CodeAnt Nitpicks1 code suggestion1. The test leaves
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| boolean currentFormat = passwordHash.startsWith("{pbkdf2-sha256-v1}"); | ||
| boolean bcryptInputAllowed = password.getBytes(StandardCharsets.UTF_8).length <= 72; | ||
| // An overlong guess must still perform BCrypt work, but can never authenticate a legacy hash. | ||
| String bcryptInput = bcryptInputAllowed ? password : "non-account-timing-placeholder"; | ||
| boolean legacyMatches = passwordEncoder.matches(bcryptInput, | ||
| currentFormat ? DUMMY_BCRYPT_HASH : passwordHash); | ||
| boolean currentMatches = passwordEncoder.matches(password, | ||
| currentFormat ? passwordHash : DUMMY_PASSWORD_HASH); |
There was a problem hiding this comment.
Suggestion: A malformed stored hash with this prefix makes passwordEncoder.matches throw, so login returns 500 instead of the expected 401 response. [api mismatch]
Assessment: 🟠 Major · 🔁 Occurrence: Rarely
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** backend/auth-service/src/main/java/com/chanter/auth/application/AuthSessionService.java
**Line:** 119:126
**Comment:**
*Api Mismatch: A malformed stored hash with this prefix makes `passwordEncoder.matches` throw, so login returns 500 instead of the expected 401 response.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| const cache = path.join(root, '.cache/backend-security'); | ||
| fs.mkdirSync(cache, { recursive: true }); | ||
| const run = fs.mkdtempSync(path.join(cache, 'run-')); |
There was a problem hiding this comment.
Suggestion: Each run keeps extracted JARs and raw scanner reports in .cache, so repeated local or persistent-runner scans continuously consume disk space. [resource leak]
Assessment: 🟠 Major · 🔁 Occurrence: Sometimes
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** scripts/security/backend-artifacts.mjs
**Line:** 35:37
**Comment:**
*Resource Leak: Each run keeps extracted JARs and raw scanner reports in `.cache`, so repeated local or persistent-runner scans continuously consume disk space.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
@CodeAnt-AI: review |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
| const libraries = new Set(results.filter(result => result.Type === 'jar') | ||
| .flatMap(result => result.Packages ?? []) | ||
| .map(pkg => pkg.FilePath?.replaceAll('\\', '/').split('/').at(-1)).filter(Boolean)); |
There was a problem hiding this comment.
Suggestion: Coverage matches only the filename, not BOOT-INF/lib; a jar elsewhere in the extracted package can falsely satisfy a missing library and let an incomplete scan pass. [incomplete implementation]
Assessment: 🟠 Major · 🔁 Occurrence: Rarely
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** scripts/security/backend-artifacts.mjs
**Line:** 9:11
**Comment:**
*Incomplete Implementation: Coverage matches only the filename, not `BOOT-INF/lib`; a jar elsewhere in the extracted package can falsely satisfy a missing library and let an incomplete scan pass.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
@CodeAnt-AI: review |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
1 participant
User description
The first production image scan found 33 high/critical findings in the old backend. This repair moves the ten services to supported Spring Boot 4.0.8 and Spring Cloud 2025.1.3, applies the Tomcat 11.0.25 security fixes, and scans every packaged Java library with explicit coverage checks. Metadata-only scans cannot pass.
Existing JSON and endpoint contracts are preserved through the official Jackson 2 compatibility module, updated Gateway routing configuration and Flyway starter. New password hashes use versioned PBKDF2 so the existing 128-character forms work; existing BCrypt hashes remain readable. Production compatibility must advance before new hashes are stored.
Refs #319; unblocks the dependency portion of #243 and PR #315. The owning issue stays open through merged-main and native release-package verification.
Validation
Architecture and operations
No service boundary or production migration SQL changes. Login performs both supported password work factors for missing, passwordless, legacy and current accounts; overlong legacy guesses cannot authenticate. Password encoding requires a deployment compatibility-epoch advance; legacy overlong BCrypt passwords require recovery. Source package scans supplement the native operating-system and infrastructure image scans in #243. Raw scan output is never published; only sanitized coverage, digests and advisory metadata are retained.
Design, implementation and system review: docs/architecture/supported-backend-and-security-scans.md. Verification log: docs/operations/issue-319-change-log.md.
Engineering impact
Canonical record: architecture-review-supported-backend-runtime@1. The canonical receipt is docs/engineering/changes/pr-320.md.
CodeAnt-AI Description
Upgrade backend services and enforce complete packaged-library security scans
What Changed
Impact
✅ Full-length and Unicode passwords work✅ Safer and more consistent login failures✅ Complete security coverage for all packaged Java libraries💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.