DTS-34986 Central AuthNAuth Spring Boot upgrade

[tibi-iordache]

Upgrading the Central AuthNAuth Spring Boot version to 3.2 and Java version to 17.
For full documentation of the upgrade, you can check the confluence page:
https://publicissapient.atlassian.net/wiki/spaces/SPDS/pages/307789878/Java+17+Upgrade

To fix the problem, we need to ensure that the redirectUri is properly sanitized before it is used. This can be achieved by validating the redirectUri against a whitelist of allowed URLs or by using a library to sanitize the URL.

• General Fix: Validate or sanitize the redirectUri before using it in window.location.href.
• Detailed Fix: Implement a function to validate the redirectUri and use this function before setting window.location.href.

To fix the problem, we need to ensure that the redirectUri is properly sanitized before it is used. One effective way to do this is to use a library like DOMPurify to sanitize the URL. This will help prevent any malicious scripts from being executed.

1. Install the DOMPurify library.
2. Import DOMPurify in the relevant files.
3. Use DOMPurify to sanitize the redirectUri before using it.

To fix the problem, we need to validate the redirectUri against a list of authorized URLs before performing the redirection. This ensures that only trusted URLs are used for redirection, mitigating the risk of phishing attacks.

1. Create a list of authorized URLs: Define a list of URLs that are considered safe for redirection.
2. Validate the redirectUri: Before using the redirectUri for redirection, check if it is in the list of authorized URLs.
3. Perform the redirection: Only redirect if the redirectUri is validated against the authorized list.

To fix the problem, we need to ensure that the redirectUri is validated against a list of authorized URLs or domains before performing the redirection. This can be achieved by maintaining a whitelist of allowed redirect URLs and checking if the redirectUri belongs to this list before using it.

1. Create a whitelist of authorized redirect URLs.
2. Validate the redirectUri against this whitelist.
3. Only perform the redirection if the redirectUri is in the whitelist; otherwise, redirect to a default safe URL.

To fix the SSRF vulnerability, we need to ensure that the jobNameKey parameter is validated against a list of known, safe values or ensure that the constructed URL is limited to a particular host or more restrictive URL prefix. Here, we will implement a whitelist approach for jobNameKey.

1. Create a whitelist of valid jobNameKey values: This can be a predefined list of acceptable keys.
2. Validate jobNameKey against the whitelist: Before constructing the URL, check if jobNameKey is in the whitelist.
3. Reject invalid jobNameKey values: If jobNameKey is not in the whitelist, log an error and do not proceed with the request.

To fix the log injection issue, we need to sanitize the jobNameKey before logging it. The best way to do this is to remove any newline characters and other potentially harmful characters from the jobNameKey. We can use the String.replace method to replace newline characters with an empty string. Additionally, we should ensure that the jobNameKey is clearly marked in the log entry to prevent any confusion.

To fix the log injection issue, we need to sanitize the user input before logging it. Specifically, we should remove any potentially harmful characters from the url parameter before it is logged. This can be done by replacing new-line characters and other special characters with safe alternatives.

1. Sanitize the url parameter by replacing new-line characters and other special characters.
2. Update the log statement to use the sanitized url.

To fix the log injection issue, we need to sanitize the user-provided data before logging it. Specifically, we should remove any potentially harmful characters such as newlines that could be used to forge log entries. We can achieve this by replacing newline characters with an empty string or a space.

1. Identify the log statement that uses kpiRequest.getKpiList() in the JenkinsServiceR class.
2. Sanitize the kpiRequest.getKpiList() data by removing newline characters before logging it.
3. Ensure that the sanitization does not alter the functionality of the code.

[hirbabar]

this PR changes is merged in #1520 PR. so not reqied this PR so that i am closeing this PR