# Security (VAPT) — GB4.7MFE

Last analyzed: 2026-02-23

---

## P0 — Critical (Fix Before Production)

### 1. Hardcoded Credentials
- `projects/costing/transaction/budget/budget.component.ts`
  - `j_username=jasperadmin&j_password=jasperadmin` hardcoded in Jasper report URL
- `projects/security/transaction/visitorpass/visitorpass.component.ts`
  - Same Jasper credentials pattern
- `features/login/service/login.service.ts:176,254,521,800`
  - AES-256 encryption key hardcoded: `'12345678901234567890123456789012'`
  - Encryption is fully compromised — move to env/secrets manager
- **Fix:** All credentials/keys must come from environment config, never source code.

### 2. XSS via bypassSecurityTrust*
- `libs/gbpipes/safepipe.pipe.ts:10` — `bypassSecurityTrustResourceUrl(url)` — trusts ANY url
- `features/gbrichtexteditor/gbrichtexteditor.component.ts:101`
  - `bypassSecurityTrustHtml(editor.getHTML())` — user-typed content trusted verbatim
  - **Fix:** Use DOMPurify: `import DOMPurify from 'dompurify'; DOMPurify.sanitize(editor.getHTML())`
- `features/gbdynamichml/gbdynamichtml.component.ts:20`
  - `bypassSecurityTrustHtml(rawHtml)` — API response HTML trusted without validation
  - **Fix:** Sanitize with DOMPurify before passing to Angular; remove bypass

### 3. Token Storage in localStorage/sessionStorage
- `features/login/service/login.service.ts:639` — `localStorage.setItem('SSOToken', token)`
  - localStorage readable by any JS — XSS + token theft = session hijack
- `features/login/service/login.service.ts:481` — Full LoginDTO in sessionStorage
  - Contains UserId, RoleId, WorkOUId
- **Fix:** Store tokens in `httpOnly; Secure; SameSite=Strict` cookies set by server

### 4. ClientSecret in URL
- `features/login/service/login.service.ts:319`
  - `'...&ClientId=GB5WEB&ClientSecret=' + keycloakkey` — secret in GET URL
  - Logged in browser history, server logs, proxy logs
- **Fix:** Move ClientSecret to POST request body only

---

## P1 — High Priority

### 5. Auth Data Logged to Console
- `features/login/service/login.service.ts:140` — logs authResult (contains tokens)
- `features/login/service/login.service.ts:345` — logs popup URL with auth params
- `features/login/service/login.service.ts:348` — logs tokenMatch value
- `features/login/service/login.service.ts:641` — logs full SSO API response
- **Fix:** Remove all auth-related console.log. Add ESLint `no-console: error` rule.

### 6. Global Window Pollution
- `features/production/others/processmapviewer/processmapviewer.component.ts:78`
  - `(window as any).onA = (nodeName: string) => {...}`
  - Attaches component callback to window — injection point, namespace pollution
- **Fix:** Use Angular EventEmitter or @Output instead

### 7. No CSRF Protection
- No anti-forgery tokens found in form submissions or API calls
- All POST endpoints vulnerable to CSRF if cookies are introduced
- **Fix:** Add CSRF token header in HTTP interceptor; validate on backend

---

## P1 — Missing Security Headers (Nginx)
Add to nginx.conf:
```nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header Referrer-Policy "no-referrer";
add_header Permissions-Policy "geolocation=(), microphone=()";
```

---

## P2 — Medium Priority

### 8. No Input Validation on sessionStorage Reads
- Pattern across many components: `JSON.parse(sessionStorage.getItem('LoginDTO') as any)`
- No null check, no schema validation, unsafe cast
- **Fix:** Create `GbAuthStorageService` with typed getters and validation

### 9. Dependency Security
- Run `npm audit` — not configured in CI
- Add to GitLab CI pipeline: `npm audit --audit-level=high`
- Check: chart.js, mermaid, tiptap for known CVEs

---

## Rules for New Modules
- NEVER use `bypassSecurityTrust*` — use DOMPurify for HTML content
- NEVER store tokens or sensitive data in localStorage/sessionStorage
- NEVER hardcode credentials, keys, or secrets in source
- NEVER put sensitive params in URL query strings
- NEVER console.log auth responses, tokens, or user PII
- ALWAYS validate and type-check data read from storage
- ALWAYS use Angular's HttpClient (interceptor adds auth headers centrally)