From d174d599a395e905c9a7e66c778bdec3b79f0afd Mon Sep 17 00:00:00 2001 From: kremi <34029797+kremi@users.noreply.github.com> Date: Fri, 9 Aug 2019 15:28:14 +0100 Subject: [PATCH 01/81] Adding back the prod deployment blocker (#189) --- Jenkinsfile_CNP | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index 9bf21d5cc..3162429ec 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -107,4 +107,8 @@ withPipeline(type, product, component) { after('smoketest:idam-demo-staging') { sh "./gradlew --no-daemon --init-script init.gradle --info --rerun-tasks functional" } + + before('buildinfra:idam-prod') { + error('Stopping pipeline before Prod stages') + } } From f22403762d5966723645a10d6dcf35955097bf36 Mon Sep 17 00:00:00 2001 From: James Burke Date: Tue, 20 Aug 2019 21:39:51 +0100 Subject: [PATCH 02/81] extra tests for code quality (#196) --- .../hmcts/reform/idam/web/AppController.java | 10 ++++++++- .../reform/idam/web/AppControllerTest.java | 22 +++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/src/main/java/uk/gov/hmcts/reform/idam/web/AppController.java b/src/main/java/uk/gov/hmcts/reform/idam/web/AppController.java index 60ab0c09b..cd657b846 100644 --- a/src/main/java/uk/gov/hmcts/reform/idam/web/AppController.java +++ b/src/main/java/uk/gov/hmcts/reform/idam/web/AppController.java @@ -351,7 +351,15 @@ public String login(@ModelAttribute("authorizeCommand") @Validated AuthorizeRequ } private String makeCookieSecure(String cookie) { - if (useSecureCookie) { + return makeCookieSecure(cookie, useSecureCookie); + } + + /** + * @should return a secure cookie if useSecureCookie is true + * @should return a non-secure cookie if useSecureCookie is false + */ + protected String makeCookieSecure(String cookie, boolean withSecureCookie) { + if (withSecureCookie) { return cookie + "; Path=/; Secure; HttpOnly"; } return cookie + "; Path=/; HttpOnly"; diff --git a/src/test/java/uk/gov/hmcts/reform/idam/web/AppControllerTest.java b/src/test/java/uk/gov/hmcts/reform/idam/web/AppControllerTest.java index 770a0410a..d323fe08a 100644 --- a/src/test/java/uk/gov/hmcts/reform/idam/web/AppControllerTest.java +++ b/src/test/java/uk/gov/hmcts/reform/idam/web/AppControllerTest.java @@ -37,6 +37,7 @@ import static com.netflix.zuul.constants.ZuulHeaders.X_FORWARDED_FOR; import static org.hamcrest.Matchers.hasItem; import static org.hamcrest.Matchers.hasItems; +import static org.hamcrest.core.Is.is; import static org.junit.Assert.assertThat; import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.anyString; @@ -1487,4 +1488,25 @@ public void authorizeError_shouldReturnAnErrorPage() throws Exception { .andExpect(status().isOk()) .andExpect(view().name(ERROR_VIEW_NAME)); } + + /** + * @verifies return a secure cookie if useSecureCookie is true + * @see AppController#makeCookieSecure(String, boolean) + */ + @Test + public void makeCookieSecure_shouldReturnASecureCookieIfUseSecureCookieIsTrue() throws Exception { + AppController appController = new AppController(); + assertThat(appController.makeCookieSecure(AUTHENTICATE_SESSION_COOKE, true), is(AUTHENTICATE_SESSION_COOKE + "; Path=/; Secure; HttpOnly")); + } + + /** + * @verifies return a non-secure cookie if useSecureCookie is false + * @see AppController#makeCookieSecure(String, boolean) + */ + @Test + public void makeCookieSecure_shouldReturnANonsecureCookieIfUseSecureCookieIsFalse() throws Exception { + AppController appController = new AppController(); + assertThat(appController.makeCookieSecure(AUTHENTICATE_SESSION_COOKE, false), is(AUTHENTICATE_SESSION_COOKE + "; Path=/; HttpOnly")); + } + } From e6d5ea44899294306deabce01a9a7e2147bf2a2d Mon Sep 17 00:00:00 2001 From: Nikola Naydenov Date: Tue, 27 Aug 2019 10:15:09 +0100 Subject: [PATCH 03/81] Removing blocker for go live --- Jenkinsfile_CNP | 4 ---- 1 file changed, 4 deletions(-) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index b5b700c16..4fd7e934a 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -105,8 +105,4 @@ withPipeline(type, product, component) { reportName : "IDAM Web Public E2E functional tests result" ] } - - before('buildinfra:idam-prod') { - error('Stopping pipeline before Prod stages') - } } From 4bb7c1672caf69355ea84a8a1ff24411f8841d19 Mon Sep 17 00:00:00 2001 From: Nikola Naydenov Date: Tue, 27 Aug 2019 11:27:53 +0100 Subject: [PATCH 04/81] Load vault secrets fix --- Jenkinsfile_CNP | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index 4fd7e934a..b60a8bd53 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -9,16 +9,18 @@ def product = "idam" def component = "web-public" env.NONPROD_ENVIRONMENT_NAME = 'idam-aat' -env.PROD_ENVIRONMENT_NAME = 'idam-prod' -env.DEMO_ENVIRONMENT_NAME = 'idam-demo' +env.PROD_ENVIRONMENT_NAME = 'idam-prod' +env.DEMO_ENVIRONMENT_NAME = 'idam-demo' env.PREVIEW_ENVIRONMENT_NAME = 'idam-preview' env.PERFTEST_ENVIRONMENT_NAME = 'idam-perftest' env.ITHC_ENVIRONMENT_NAME = 'idam-ithc' -List> secrets = [ - secret('smoke-test-user-username', 'SMOKE_TEST_USER_USERNAME'), - secret('smoke-test-user-password', 'SMOKE_TEST_USER_PASSWORD'), - secret('notify-api-key', 'NOTIFY_API_KEY') +def secrets = [ + 'idam-idam-${env}': [ + secret('smoke-test-user-username', 'SMOKE_TEST_USER_USERNAME'), + secret('smoke-test-user-password', 'SMOKE_TEST_USER_PASSWORD'), + secret('notify-api-key', 'NOTIFY_API_KEY') + ] ] static LinkedHashMap secret(String secretName, String envVar) { @@ -79,7 +81,7 @@ withPipeline(type, product, component) { reportName : "IDAM Web Public E2E smoke tests result" ] } - + after('functionalTest:idam-preview') { archiveArtifacts '**/build/test-results/**/*' From 934d75e10b5dd6e61c6df1bea7ef600bc9839c47 Mon Sep 17 00:00:00 2001 From: Nikola Naydenov Date: Tue, 27 Aug 2019 17:20:47 +0100 Subject: [PATCH 05/81] Security fix --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index fcdfffc42..5f7ee0423 100644 --- a/build.gradle +++ b/build.gradle @@ -80,7 +80,7 @@ allprojects { compile group: 'javax.servlet', name: 'jstl' compile group: 'javax.json', name: 'javax.json-api' - compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.9.1' + compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.9.3' compile group: 'com.nimbusds', name: 'nimbus-jose-jwt' compile group: 'org.apache.httpcomponents', name: 'httpclient' compile group: 'org.apache.httpcomponents', name: 'httpcore' From aaa8965d3da66802a70aa5c3f9525c193ab0dc71 Mon Sep 17 00:00:00 2001 From: Nikola Naydenov Date: Wed, 28 Aug 2019 10:20:02 +0100 Subject: [PATCH 06/81] Adding go live blocker --- Jenkinsfile_CNP | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Jenkinsfile_CNP b/Jenkinsfile_CNP index b60a8bd53..999709eb9 100644 --- a/Jenkinsfile_CNP +++ b/Jenkinsfile_CNP @@ -107,4 +107,8 @@ withPipeline(type, product, component) { reportName : "IDAM Web Public E2E functional tests result" ] } + + before('buildinfra:idam-prod') { + error('Stopping pipeline before Prod stages') + } } From 91446c4f9dde085ff0f44337f46496fcfd5d7b82 Mon Sep 17 00:00:00 2001 From: dfourn Date: Wed, 28 Aug 2019 10:25:21 +0100 Subject: [PATCH 07/81] Securityscan master (#197) * adding security scan config * update public uRI * adding fun-output dir to gitignore * adding aat url * Exclude jquery from the zap scanners. --- security.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security.sh b/security.sh index 4adad9e0a..cca8abcac 100644 --- a/security.sh +++ b/security.sh @@ -10,6 +10,7 @@ while !(curl -s http://0.0.0.0:1001) > /dev/null echo "ZAP has successfully started" zap-cli --zap-url http://0.0.0.0 -p 1001 status -t 120 zap-cli --zap-url http://0.0.0.0 -p 1001 open-url "${TEST_URL}" + zap-cli --zap-url http://0.0.0.0 -p 1001 exclude ".*jquery-3.4.1.min.js$" zap-cli --zap-url http://0.0.0.0 -p 1001 spider ${TEST_URL} zap-cli --zap-url http://0.0.0.0 -p 1001 active-scan --scanners all --recursive "${TEST_URL}" zap-cli --zap-url http://0.0.0.0 -p 1001 report -o activescan.html -f html @@ -17,4 +18,4 @@ while !(curl -s http://0.0.0.0:1001) > /dev/null chown -R $(id -u):$(id -u) activescan.html cp *.html functional-output/ zap-cli -p 1001 alerts -l Informational - zap-cli --zap-url http://0.0.0.0 -p 1001 alerts -l High --exit-code False + zap-cli --zap-url http://0.0.0.0 -p 1001 alerts -l High --exit-code False From ba524590c9ea7e4834b61617d328df9071619885 Mon Sep 17 00:00:00 2001 From: dfourn Date: Wed, 18 Sep 2019 14:01:11 +0100 Subject: [PATCH 08/81] [PREVIEW] Fixing the pipeline (#211) * [PREVIEW] SIDM-3007 SIDM-3089 SIDM-3090 Fix PR asp_name, update Dockerfile, add CVE suppression (#201) * fix(local.asp_name): add conditional case for asp_name when running PRs By using the asp_name_override for idam-api, idam-web-public and idam-web-admin for PRs, pipelines cannot run in parallel as they clash with each other. Do not use asp_name_override for PRs. * feat(security suppression): add suppression for pitest related to CVE-2019-15052 pitest 1.3.0 and 1.4.0 are flagged under CVE-2019-15052 but are only used in testing. 1.4.0 is the latest release SIDM-3090 * fix(base image/insights agent): update Dockerfile as base image is no longer available * Change ref in the terraform file. --- Dockerfile | 21 +++++++++++++++++++++ dependency-check-suppressions.xml | 13 +++++++++++++ infrastructure/main.tf | 4 ++-- 3 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..c25373e3e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,21 @@ +ARG APP_INSIGHTS_AGENT_VERSION=2.4.0 + +FROM hmctspublic.azurecr.io/base/java:openjdk-8-distroless-1.1 + +LABEL maintainer=IDAM \ + owner="HM Courts & Tribunals Service" + +# Docker Base Image Defaults +# WORKDIR is /opt/app +# USER is hmcts +# ENTRYPOINT is /usr/bin/java -jar + +ENV SERVER_PORT=8080 + +ADD --chown=hmcts:hmcts build/libs/idam-web-public.war \ + lib/AI-Agent.xml \ + lib/applicationinsights-agent-2.4.0.jar /opt/app/ + +CMD ["idam-web-public.war"] + +EXPOSE 8080/tcp diff --git a/dependency-check-suppressions.xml b/dependency-check-suppressions.xml index 2b955bc6b..626f5de2e 100644 --- a/dependency-check-suppressions.xml +++ b/dependency-check-suppressions.xml @@ -193,4 +193,17 @@ CVE-2014-0119 CVE-2016-5388 + + + + + https://www.cvedetails.com/cve/CVE-2019-15052/ + The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007. + This should not apply to the project as this package is only used in testing. + + ^info\.solidsoft\.gradle\.pitest:gradle-pitest-plugin:1\.3\.0$ + CVE-2019-15052 + diff --git a/infrastructure/main.tf b/infrastructure/main.tf index 8248f04ea..59c15a15c 100644 --- a/infrastructure/main.tf +++ b/infrastructure/main.tf @@ -16,7 +16,7 @@ locals { idam_api_testing_support_url = "${var.idam_api_testing_support_url_override != "" ? var.idam_api_testing_support_url_override : local.idam_api_url}" default_asp_name = "${var.product}-${var.env}" - asp_name = "${coalesce(var.asp_name_override, local.default_asp_name)}" + asp_name = "${substr(var.product, 0, 3) == "pr-" ? local.default_asp_name : coalesce(var.asp_name_override, local.default_asp_name)}" default_asp_rg = "${var.product}-${var.env}" asp_rg = "${coalesce(var.asp_rg_override, local.default_asp_rg)}" @@ -35,7 +35,7 @@ data "azurerm_key_vault" "cert_vault" { } module "idam-web-public" { - source = "git@github.com:hmcts/cnp-module-webapp?ref=master" + source = "git@github.com:hmcts/cnp-module-webapp?ref=SIDM-3089" product = "${var.product}-${var.app}" location = "${var.location}" env = "${var.env}" From 54cebfdc4eedaf848513b6a92947fcdbb78e3cae Mon Sep 17 00:00:00 2001 From: dfourn Date: Wed, 18 Sep 2019 14:01:25 +0100 Subject: [PATCH 09/81] [PREVIEW] Minor content changes for 1.4.1 (#210) * SIDM-3130 Contact Us screen - Update SSCS details. * SIDM-2904 Update Survey feedback link across IDAM public screens. --- src/main/webapp/WEB-INF/jsp/contactus.jsp | 8 ++++---- src/main/webapp/WEB-INF/tags/wrapper.tag | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/main/webapp/WEB-INF/jsp/contactus.jsp b/src/main/webapp/WEB-INF/jsp/contactus.jsp index 813fd7368..8b07ee24d 100644 --- a/src/main/webapp/WEB-INF/jsp/contactus.jsp +++ b/src/main/webapp/WEB-INF/jsp/contactus.jsp @@ -22,7 +22,7 @@

Money Claims

    -
  • Email: moneyclaims@hmcts.gsi.gov.uk
    • +
  • Email: moneyclaims@justice.gov.uk
  • Phone: 0300 123 7050
  • Monday to Friday, 9am to 5pm
  • Find out about call charges
    • @@ -36,7 +36,7 @@
-

Social Security and Child Support Tribunal (England and Wales)

+

Appeal a benefit decision (England and Wales)

  • Phone: 0300 123 1142
  • Monday to Friday, 8:30am to 5pm
    • @@ -44,9 +44,9 @@
-

Social Security and Child Support Tribunal (Scotland)

+

Appeal a benefit decision (Scotland)

diff --git a/src/main/webapp/WEB-INF/tags/wrapper.tag b/src/main/webapp/WEB-INF/tags/wrapper.tag index 6e105c226..accd4eadb 100644 --- a/src/main/webapp/WEB-INF/tags/wrapper.tag +++ b/src/main/webapp/WEB-INF/tags/wrapper.tag @@ -124,7 +124,7 @@

From a00aeb547abf36c4a0e6f5c81126117d5fcfc748 Mon Sep 17 00:00:00 2001 From: nikola-naydenov-hmcts <47384516+nikola-naydenov-hmcts@users.noreply.github.com> Date: Wed, 25 Sep 2019 12:40:15 +0100 Subject: [PATCH 10/81] [PREVIEW] 1.4.1 Scope Change (#216) (#218) * SIDM-2904 Manually revert SIDM-2904. * SIDM-2757 Fix double apostrophe in a message. (#187) * [PREVIEW] footer pages update (#194) * Add 'Family Public Law' section to the 'Contact Us' page. * Add Family Public Law Service info to cookies and privacy policy pages. * A few adjustements. * Remove repetition. * Add a space. * SIDM-2412 Remove records about 2 cookies which are not used in the Family Public Law Service. (#204) --- src/main/resources/messages.properties | 2 +- src/main/webapp/WEB-INF/jsp/contactus.jsp | 6 + src/main/webapp/WEB-INF/jsp/cookies.jsp | 131 +++++++++++++++++- src/main/webapp/WEB-INF/jsp/privacypolicy.jsp | 58 +++++++- src/main/webapp/WEB-INF/tags/wrapper.tag | 2 +- 5 files changed, 190 insertions(+), 9 deletions(-) diff --git a/src/main/resources/messages.properties b/src/main/resources/messages.properties index 7d76d1b1d..5d535b7de 100644 --- a/src/main/resources/messages.properties +++ b/src/main/resources/messages.properties @@ -150,7 +150,7 @@ public.common.user.created.sent.confirmation.email=We''ve sent a confirmation em public.common.user.created.follow.instruction=Follow the instructions to finish creating your account. public.common.user.created.mail.not.arrived=Can't see the email? public.common.user.created.few.minutes=It can take a few minutes to arrive. Check your junk mail if you can't see it in your inbox. -public.common.user.created.re.enter.details=If you still can''t see it +public.common.user.created.re.enter.details=If you still can't see it public.common.user.created.re.enter.details.enter.details.again=enter your details again. diff --git a/src/main/webapp/WEB-INF/jsp/contactus.jsp b/src/main/webapp/WEB-INF/jsp/contactus.jsp index 8b07ee24d..ad0779f05 100644 --- a/src/main/webapp/WEB-INF/jsp/contactus.jsp +++ b/src/main/webapp/WEB-INF/jsp/contactus.jsp @@ -19,6 +19,12 @@
  • Monday to Friday, 8:30am to 5pm
  • Find out about call charges
    • + + +

    Family Public Law

    +
      +
    • Email: dcd-familypubliclawservicedesk@hmcts.net
      • +

    Money Claims

      diff --git a/src/main/webapp/WEB-INF/jsp/cookies.jsp b/src/main/webapp/WEB-INF/jsp/cookies.jsp index 216791cff..f31550528 100644 --- a/src/main/webapp/WEB-INF/jsp/cookies.jsp +++ b/src/main/webapp/WEB-INF/jsp/cookies.jsp @@ -22,6 +22,7 @@ +
      @@ -217,7 +218,6 @@ -

      We allow Google to use or share this data. Find out more about how they use this information in the Google privacy policy

      Cookies used to turn our introductory message off

      You may see a welcome message when you first visit the service. We’ll store a cookie so that your computer knows not to show this message again.

      @@ -525,7 +525,134 @@
      - +
      +

      Cookies in the family public law service

      +

      Cookies used to measure website usage

      +

      We use Google Analytics software to collect information about how you use this service. We do this to help make sure the service is meeting the needs of its users and to help us make improvements, for example improving site search.

      +

      Google Analytics stores information about:

      +
        +
      • the pages you visit
        • +
      • how long you spend on each page
        • +
      • how you got to the service
        • +
      • what you click on while you’re visiting the service
        • +
      +

      We allow Google to use or share our analytics data. You can find out more about how Google use this information in their Privacy Policy.

      +

      You can opt out of Google Analytics if you do not want Google to have access to your information

      +

      Google Analytics sets the following cookies:

      + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cookie nameWhat this cookie is forExpires after
      _gaThis helps us count how many people visit the service by tracking if you’ve visited before2 years
      _gatManages the rate at which page view requests are made10 minutes
      _gidIdentifies you to the service24 hours
      +

      Cookies used to turn our introductory message off

      +

      You may see a welcome message when you first visit the service. We’ll store a cookie so that your computer knows not to show this message again.

      + + + + + + + + + + + + + + + +
      Cookie nameWhat this cookie is forExpires after
      seen_cookie_messageSaves a message to let us know that you’ve seen our cookie message1 month
      +

      Cookies used to store the answers you’ve given during your visit (known as a ‘session’)

      +

      Session cookies are stored on your computer as you travel through a website, and let the website know what you’ve seen and done so far. These are temporary cookies and are automatically deleted a short while after you leave the website.

      + + + + + + + + + + + + + + + + + + + + +
      Cookie nameWhat this cookie is forExpires after
      connect.sidCarries details of your current sessionWhen you close your browser
      sessionKeyProtects your session using encryptionWhen you close your browser
      +

      Cookies used to identify you when you come back to the service

      +

      We use authentication cookies to identify you when you return to the service.

      + + + + + + + + + + + + + + + +
      Cookie nameWhat this cookie is forExpires after
      __auth-tokenIdentifies you to the serviceWhen you close your browser
      +

      Cookies used to make the service more secure

      +

      We set cookies which prevent attackers from modifying the contents of the other cookies we set. This makes the service more secure and protects your personal information.

      + + + + + + + + + + + + + + + + + + + + + + + + + +
      Cookie nameWhat this cookie is forExpires after
      TSxxxxxxxxProtects your session from tamperingWhen you close your browser
      __stateIdentifies you to the service and secures your authenticationWhen you close your browser
      X_CMCHelps us keep track of your sessionWhen you close your browser
      +
      diff --git a/src/main/webapp/WEB-INF/jsp/privacypolicy.jsp b/src/main/webapp/WEB-INF/jsp/privacypolicy.jsp index a74ca2ebb..1122845d8 100644 --- a/src/main/webapp/WEB-INF/jsp/privacypolicy.jsp +++ b/src/main/webapp/WEB-INF/jsp/privacypolicy.jsp @@ -20,19 +20,19 @@ +
      +